CVE-2024-29460

MediumCVSS 6.6/10Last modified Jun 17, 2026

Description

An issue in PX4 Autopilot v.1.14.0 allows an attacker to manipulate the flight path allowing for crashes of the drone via the home point location of the mission_block.cpp component.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-229

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
dronecode	px4_drone_autopilot	1.14.0

References

https://github.com/Drone-Lab/PX4-Autopilot/blob/report-can%27t-finish-mission/report-can%27t-finish-mission.mdExploit, Patch, Vendor Advisory
https://github.com/Drone-Lab/PX4-Autopilot/blob/report-can%27t-finish-mission/report-can%27t-finish-mission.mdExploit, Patch, Vendor Advisory

Timeline

Published: Apr 10, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-294616.3An issue in Floodlight SDN OpenFlow Controller v.1.2 allows a remote attacker to cause a denial of service via the datapath id component.CVE-2024-294668.8Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.CVE-2024-294696.1A stored cross-site scripting (XSS) vulnerability in OneBlog v2.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted CVE-2024-29477.3A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerab CVE-2024-294706.1OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component {{rootpath}}/links.CVE-2024-294715.4OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notice Manage module.CVE-2024-294725.4OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Privilege Management module.CVE-2024-294736.1OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Role Management module.CVE-2024-294745.4OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Management module.CVE-2024-294778.8Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the net CVE-2024-29486.4The Favorites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user_favorites' shortcode in all versions CVE-2024-294895.5Jerryscript 2.4.0 has SEGV at ./jerry-core/ecma/base/ecma-helpers.c:238:58 in ecma_get_object_type.