CPExploiter: from Cyber to Physical: Understanding the End-to-End Physical Attack Capability of Cyber-Attacks on Robotic Vehicles

Robotic Vehicles (RVs), particularly drones, represent critical cyber-physical systems that are fundamentally dependent on network connectivity for operation and thus susceptible to network-based cyber-attacks. While such drone-targeted cyber-attacks have been considerably studied in literature, we find that the majority (76.3%) of them focus on the cyber-vulnerability discovery and validation only without any experimental understanding of whether such cyber-attacks can indeed cause meaningful physical impacts at the end-to-end RV system operation level; in fact, some of them (26.3%) do not even describe the potential of causing such end-to-end physical impacts. In this work, we present CPExploiter, a novel framework to systematically reveal how network-based cyber vulnerabilities in RVs can escalate into severe physical failures. It uses structured VEI scenarios and automates escalation discovery via UAV-specific parameters, guided in part by Large Language Models (LLMs), to expose cascading failure patterns and high-severity outcomes at the system level. This demonstration will include videos and figures of CPExploiter in action, showcasing the structured mapping of Vulnerability-Exploit-Impact (VEI) scenarios, automated discovery of escalation paths, and validation of end-to-end physical impacts through both Software-in-the-Loop (SITL) simulation and real-world UAV experimentation.