CVE-2021-44319 in AR.Drone
Summary
by MITRE • 09/04/2026
Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. The Parrot AR.Drone platform is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flight.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The Parrot AR.Drone series, encompassing both the first and second generations, represents a significant class of consumer-grade unmanned aerial vehicles that rely heavily on wireless communication protocols for operational control. These devices utilize Wi-Fi technology to establish a link between the drone's onboard flight controller and the ground-based remote control interface or mobile application. This reliance on unencrypted or weakly secured wireless channels creates an inherent attack surface that can be exploited by malicious actors with physical proximity to the device during operation. The vulnerability identified in these platforms stems from the lack of robust authentication mechanisms within the Wi-Fi communication layer, specifically regarding management frames which are critical for maintaining connection integrity.
The core technical flaw lies in the drone's susceptibility to IEEE 802.11 deauthentication attacks. In standard wireless networking, deauthentication frames are used to terminate a session between two stations and an access point or direct peer-to-peer link. These frames are typically sent unencrypted because they belong to the management frame category of the Wi-Fi protocol stack, which prioritizes efficiency over security in many legacy implementations. An attacker equipped with appropriate radio hardware can craft and broadcast spoofed deauthentication packets that impersonate either the drone or the controller. Because the Parrot AR.Drone firmware does not adequately validate these frames against a secure session state or implement countermeasures such as 802.1w Protected Management Frames, it accepts them at face value. This allows an unauthenticated remote attacker to forcibly disconnect the drone from its control source without needing any prior credentials or access keys.
The operational impact of this vulnerability is severe and potentially dangerous depending on the flight conditions. When a deauthentication attack succeeds during mid-flight, the immediate loss of command link triggers the drone's fail-safe mechanisms. Typically, these drones are programmed to either hover in place if GPS signal is available or initiate an emergency landing procedure if it is not. In scenarios where the drone is operating at high altitudes, over water, or in areas with poor satellite coverage, this sudden disconnect can lead to a crash resulting in significant hardware damage. Furthermore, there are privacy and safety implications; a malicious actor could potentially force the drone out of its operational zone, leading to unauthorized data collection if cameras remain active during descent, or causing physical harm to bystanders if the device falls from height in populated areas. The ability to execute this attack remotely and without authentication makes it particularly attractive for denial-of-service campaigns targeting specific individuals or public events involving drones.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write when considering potential memory corruption aspects if the malformed frames are processed incorrectly by lower-level drivers, but more accurately maps to CWE-295: Improper Certificate Validation and CWE-346: Origin Authentication Bypass for Cryptographic Protocols. In terms of offensive security frameworks, this attack vector is categorized under MITRE ATT&CK technique T1078: Valid Accounts or specifically the sub-technique related to wireless network attacks where an adversary disrupts connectivity by exploiting protocol weaknesses in Wi-Fi management frames. The lack of mutual authentication between the client and the access point (or direct link) allows for this type of session hijacking or disruption, highlighting a fundamental design oversight in early consumer drone security architectures.
Mitigation strategies primarily involve firmware updates provided by Parrot that may implement stricter validation of incoming packets or disable certain legacy Wi-Fi modes if available. However, given the age of these platforms, official support may have ceased, leaving users with limited software-based fixes. The most effective mitigation is physical and procedural; operators should ensure they are in secure environments where unauthorized individuals cannot easily access their radio spectrum to transmit deauthentication frames. Additionally, using drones that support WPA3 or at least WPA2-Enterprise for control links would provide stronger authentication mechanisms, although this may not be feasible for legacy hardware. Users must also remain vigilant regarding the physical location of their drone during flight and consider implementing geofencing features if supported by the specific model to limit operational range to trusted areas where signal integrity can be more reliably monitored.