CVE-2020-10283

RVD#3317: MAVLink version handshaking allows for an attacker to bypass authentication

State: Published
Severity: 8.1 High
Published: Aug 20, 2020
Updated: Sep 16, 2024
Reserved: Mar 10, 2020

Description

The Micro Air Vehicle Link (MAVLink) protocol presents authentication mechanisms on its version 2.0 however according to its documentation, in order to maintain backwards compatibility, GCS and autopilot negotiate the version via the AUTOPILOT_VERSION message. Since this negotiation depends on the answer, an attacker may craft packages in a way that hints the autopilot to adopt version 1.0 of MAVLink for the communication. Given the lack of authentication capabilities in such version of MAVLink (refer to CVE-2020-10282), attackers may use this method to bypass authentication capabilities and interact with the autopilot directly.

Scores

CVSS	Score	Vector	Source
3.0	8.1 High	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	Alias

Weaknesses

CWE-288

Affected Products

Product	Versions
MAVLinkPX4	2.0Affected

References

https://github.com/aliasrobotics/RVD/issues/3316

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.