提出 #741323: DJI DJI Mavic Mini, Spark, Mini SE 01.00.0500 and Below Authentication Bypass by Capture-replay

DJI drones running Enhanced Wi-Fi transmission system uses WEP encryption which is easily crackable. This allows adversaries to transmit commands to the drone or remote controller as long as the WEP key is encrypted.

It is discovered that during the pairing sequence for the drone and RC, a series of bytes are sent to set the drone into a pairing mode. By decrypting this sequence, the connection bytes are discovered and can be used to retransmit it to other drones. By reencrypting this sequence of bytes and amending the packet to the correct MAC address, it is possible to force a disconnect between any drone and its RC regardless of its flight state, thus performing an availability attack on any drone.

DJI drones using the Enhanced-WiFi transmission system employ WEP encryption, which is cryptographically weak and susceptible to key recovery. An attacker within wireless range who obtains the WEP key can inject crafted IEEE 802.11 frames into the communication channel between the drone and its remote controller (RC).

During the drone–RC pairing process, a specific sequence of bytes is transmitted to place the drone into pairing mode. Once this sequence is decrypted, the same byte sequence can be re-encrypted and replayed with a modified destination MAC address. By retransmitting this crafted packet, an attacker can forcibly terminate the connection between any drone and its paired RC.

This replay-based attack can be performed regardless of the drone’s flight state, resulting in a denial-of-service condition and loss of control & telemetry, impacting the availability of affected DJI drones.

• ソース: ⚠️ https://github.com/ByteMe1001/DJI-CatNect
• ユーザー: byteme1001 (UID 89355)
• 送信: 2026年01月17日 09:33 (5 月 ago)
• モデレーション: 2026年02月01日 17:36 (15 days later)
• ステータス: 承諾済み
• VulDBエントリ: 343674 [DJI Mavic Mini/Air/Spark/Mini SE 迄 01.00.0500 Enhanced Wi-Fi Pairing 弱い認証]
• ポイント: 20