DroneFuzz: Detecting Cyber-Physical Peripheral Vulnerabilities via MAVLink Fuzzing

Abstract

Robotic vehicles, such as Unmanned Aerial Vehicles (UAVs), are deployed in safety-critical applications ranging from package delivery to search and rescue operations. In these cyber-physical systems, software vulnerabilities can cause physical consequences such as collisions and mission failures, giving them direct safety implications. Most existing security research has focused on core control software. However, peripheral subsystems such as proximity sensors, optical flow sensors, and camera gimbals remain under-tested despite directly influencing control decisions, creating opportunities for attackers to manipulate vehicle behavior without immediately triggering software-level alarms. In this paper, we present DroneFuzz, a fuzzing framework for discovering cyber-physical vulnerabilities (CPVs) in robotic vehicle peripheral subsystems. DroneFuzz targets MAVLink-based systems and uses a grammar-based mutation engine to generate semantically valid peripheral inputs. The engine parses publicly available MAVLink XML specifications to produce well-formed messages, allowing us to explore peripheral-dependent code paths. DroneFuzz addresses the challenge of separating genuine safety violations from normal flight variations caused by wind, turbulence, and sensor noise using a novel hybrid bug oracle that combines Dynamic Time Warping (DTW) with Long Short-Term Memory (LSTM) autoencoders. We evaluate DroneFuzz on ArduPilot and PX4, two widely used autopilot systems. DroneFuzz reproduces five known vulnerabilities and discovers two previously unknown bugs in proximity sensor and optical flow subsystems. To support reproducibility, we release our implementation of the framework and configuration artifacts. These findings indicate that peripheral subsystems are a practical and largely overlooked attack surface.