CVE-2025-10250 in Mavic Spark
Summary
by MITRE • 09/11/2025
A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Executing manipulation can lead to use of hard-coded cryptographic key . The attacker needs to be present on the local network. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2025
The vulnerability identified in DJI Mavic Spark, Mavic Air, and Mavic Mini devices represents a critical cryptographic weakness within the Telemetry Channel component of these unmanned aerial vehicles. This flaw specifically targets an unknown function within the telemetry system that handles communication between the drone and its controller. The vulnerability stems from the use of hard-coded cryptographic keys, which fundamentally undermines the security architecture of these devices. According to security analysis, the exploitation requires an attacker to be physically present on the local network, indicating a local privilege escalation vector that could potentially be leveraged for more sophisticated attacks. The high complexity level associated with this attack suggests that while the vulnerability exists, its exploitation requires significant technical expertise and resources, yet the fact that public exploits are available indicates that determined adversaries can potentially capitalize on this weakness.
The technical implementation of this vulnerability involves the improper handling of cryptographic materials within the telemetry channel functionality. Hard-coded keys represent a fundamental security flaw that violates established cryptographic best practices and aligns with CWE-327, which addresses the use of insecure cryptographic algorithms and key management practices. The telemetry channel component typically handles sensitive flight data, communication protocols, and control signals that are essential for drone operation, making this vulnerability particularly dangerous. When cryptographic keys are hard-coded into firmware, they become permanently exposed and can be extracted through reverse engineering or direct system access, eliminating the security benefits of cryptographic protection.
The operational impact of this vulnerability extends beyond simple data confidentiality breaches, as it could enable complete compromise of the affected drone systems. An attacker with local network access could potentially intercept, modify, or inject commands into the telemetry channel, leading to unauthorized control of the drones. This represents a significant risk to both personal privacy and safety, as compromised drones could be used for surveillance, data collection, or even malicious interference with other systems. The vulnerability affects devices that are no longer supported by the manufacturer, which means that users have no official security updates or patches available to address this weakness, creating a persistent risk for affected users who continue to operate these devices.
Given that these devices are no longer maintained by DJI, the recommended mitigation strategies focus on operational security measures rather than technical patches. Users should immediately disconnect affected devices from untrusted networks and implement network segmentation to limit potential attack vectors. Network monitoring solutions should be deployed to detect anomalous telemetry channel activity that might indicate exploitation attempts. The vulnerability's classification as affecting unsupported products aligns with ATT&CK technique T1547.001, which addresses the use of persistence mechanisms and the exploitation of legacy systems that lack current security updates. Organizations and individuals should consider replacing affected devices with newer models that have proper security updates and support, as the lack of vendor support means no future security improvements can be expected. Additionally, physical security measures such as restricting access to the local network and implementing strong authentication for network access should be considered to minimize the attack surface for this particular vulnerability.