Description

An issue in EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the checkCollisionCallback, execFSMCallback, planFromGlobalTraj in ego_replan_fsm.cpp

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-10T22:16:59.190Z",
  "pubdate": "2026-09-10T22:16:59.190Z",
  "executiveSummary": "EGO-Planner-v2 is vulnerable to a denial of service (DoS) condition affecting its motion planning and finite state machine (FSM) callbacks.\nThe vulnerability allows an attacker to disrupt the operational availability of the drone's planning stack, which is critical for autonomous navigation.\nAffected components include the collision detection and trajectory replanning logic within ego_replan_fsm.cpp.\nThe flaw manifests in all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42.\nExploitation involves triggering specific callback functions with crafted inputs that likely induce resource exhaustion or logical deadlocks, halting the robot's motion control loop.\nGiven the critical role of these callbacks in real-time robotics, the impact includes potential system crashes, loss of control, or total failure of the autonomous system.",
  "technicalDetails": "The vulnerability resides within the ego_replan_fsm.cpp file, specifically affecting three key callback functions: checkCollisionCallback, execFSMCallback, and planFromGlobalTraj.\nThese functions constitute the core reactive loop of the EGO-Planner-v2 system, responsible for environmental monitoring, state transitions, and trajectory generation.\nThe root cause appears to be improper handling of inputs or state transitions within these asynchronous ROS (Robot Operating System) callbacks. When processed, these functions likely fail to account for edge-case environmental data or malformed trajectory constraints, leading to resource-intensive operations or execution stalls.\nThe attack flow typically begins with an attacker injecting malicious data—such as synthesized sensor inputs or trajectory requests—into the relevant ROS topics that trigger these callbacks. Because the system is designed to respond dynamically to its environment, the influx of unexpected data forces the planner to enter a recursive, high-latency, or exception-prone execution path.\nWithin checkCollisionCallback, the vulnerability may stem from an infinite loop or excessive memory allocation triggered by processing complex collision geometry that is not properly bounded. Similarly, execFSMCallback is susceptible if malicious states or transition events cause an unhandled exception that propagates to the main execution thread, resulting in a process crash.\nThe planFromGlobalTraj function is critical for replanning; if an attacker provides a trajectory that causes the optimizer to fail or enter a non-convergent state, the CPU utilization can spike to 100%, effectively starving the rest of the drone's software stack of necessary computation time.\nThis vulnerability is particularly severe because the affected components operate in a real-time context. A crash or hang in these functions immediately halts the navigation logic, rendering the autonomous agent unresponsive. As this code does not specify authentication or privilege requirements at the ROS node level, any entity capable of communicating with the node's topics can trigger the denial of service.\nPost-exploitation, the robot ceases all autonomous activity. In a field environment, this necessitates manual recovery, as the system fails to transition into a failsafe or hover state when the FSM loop is compromised, potentially leading to kinetic incidents."
}