← back
CVE-2020-10283

RVD#3317: MAVLink version handshaking allows for an attacker to bypass authentication

CVSS 8.1 HIGHEPSS 1.5%CWE-288
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 8.1EPSS 1.5%KEV nãoPoC Nuclei Metasploit Patch
Lifecycle
20 Aug 2020Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The Micro Air Vehicle Link (MAVLink) protocol presents authentication mechanisms on its version 2.0 however according to its documentation, in order to maintain backwards compatibility, GCS and autopilot negotiate the version via the AUTOPILOT_VERSION message. Since this negotiation depends on the answer, an attacker may craft packages in a way that hints the autopilot to adopt version 1.0 of MAVLink for the communication. Given the lack of authentication capabilities in such version of MAVLink (refer to CVE-2020-10282), attackers may use this method to bypass authentication capabilities and interact with the autopilot directly.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
PX4 · MAVLink

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →