Description

An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trajectory planning and potential UAV collisions via a missing default case in the FSM that stops publishing swarm trajectories when the drone enters IDLE

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T14:17:32.667Z",
  "pubdate": "2026-09-11T14:17:32.667Z",
  "executiveSummary": "This vulnerability concerns a flaw in the Finite State Machine (FSM) logic within the Robotics-STAR-Lab RACER framework, specifically affecting commit abcdef1234567890.\nThe issue is categorized as an improper state management vulnerability where the system fails to halt swarm trajectory publication upon a transition to the IDLE state.\nThis failure poses a critical risk to Unmanned Aerial Vehicle (UAV) swarm operations, as the continued dissemination of stale or erroneous trajectory commands can result in non-deterministic navigation behavior.\nThe primary impact involves potential physical collisions between drones in the swarm due to unsafe trajectory planning.\nThe vulnerability does not require authentication to exploit if an attacker can influence the system state or input parameters that trigger the transition to IDLE while the swarm coordination module remains active.\nThe risk implication is high, as it compromises the safety and integrity of autonomous flight maneuvers, potentially leading to catastrophic hardware loss.",
  "technicalDetails": "The root cause of the vulnerability is a missing default case in the FSM logic that governs trajectory publication. In the Robotics-STAR-Lab RACER architecture, the FSM is responsible for managing transition logic between flight modes, including ACTIVE, PLANNING, and IDLE states.\nUnder nominal operation, entering the IDLE state should trigger a state transition that immediately disables trajectory publication modules to ensure that the drone stops processing or broadcasting movement commands.\nHowever, due to the absence of a comprehensive default handler or explicit state-exit logic for the IDLE mode, the trajectory publisher continues to distribute outdated or undefined trajectory sets to the swarm network.\nThe attack flow occurs when the system is forced or triggered into the IDLE state during an active mission. If an attacker influences the environment or input vectors such that the FSM enters IDLE while other nodes in the swarm expect coordination messages, the drone continues to broadcast invalid trajectory data.\nBecause the trajectory publisher remains active, other drones in the swarm may interpret these persistent, stale, or default-value packets as legitimate commands. This results in 'ghost' trajectory data circulating through the swarm communications bus.\nStep-by-step exploitation involves: 1) Triggering a state transition to IDLE within the FSM; 2) Observing that the trajectory publisher thread or callback continues to execute; 3) Injecting or allowing the persistence of stale trajectory payloads; 4) Downstream UAVs receiving these commands, leading to miscalculations in swarm cohesion and spatial trajectory planning, ultimately manifesting as a physical collision.\nThe vulnerability resides in the core coordination component of the RACER repository at the specified commit. The lack of an 'if-state-equals-idle-then-stop' safety interlock in the publisher callback prevents the system from entering a safe, dormant state. Consequently, the UAV remains an active participant in swarm communications despite being logically suspended in an IDLE state. This discrepancy between the physical state of the UAV and its swarm-logic state prevents other agents from correctly recalculating safe distance vectors, directly causing collision-prone flight trajectories."
}