CVE-2025-10250

A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Executing manipulation can lead to use of hard-coded cryptographic key . The attacker needs to be present on the local network. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS v3 5.0 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.4

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:A/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 3.2 / Impact : 6.4

Access Vector ADJACENT_NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/ByteMe1001/DJI-Enhanced-WiFi-Weak-Cryptography
https://vuldb.com/?ctiid.323609
https://vuldb.com/?id.323609
https://vuldb.com/?submit.639757

Configurations

No configuration.

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Se ha identificado una debilidad en DJI Mavic Spark, Mavic Air y Mavic Mini 01.00.0500. Afecta a una función desconocida del componente Canal de Telemetría. La ejecución de una manipulación puede llevar al uso de una clave criptográfica codificada de forma rígida. El atacante necesita estar presente en la red local. Un alto nivel de complejidad está asociado con este ataque. Se dice que la explotabilidad es difícil. El exploit se ha puesto a disposición del público y podría ser explotado. Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el mantenedor.

Information

Published : 2025-09-11 12:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-10250

Mitre link : CVE-2025-10250

CVE.ORG link : CVE-2025-10250

JSON object : View

Products Affected

No product.

CWE

CWE-320

Key Management Errors

CWE-321

Use of Hard-coded Cryptographic Key

{"id": "CVE-2025-10250", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "cna@vuldb.com"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10250", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-11T13:28:04.183322Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:H/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.2, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"vendor": "DJI", "modules": ["Telemetry Channel"], "product": "Mavic Spark", "versions": [{"status": "affected", "version": "01.00.0500"}]}, {"vendor": "DJI", "modules": ["Telemetry Channel"], "product": "Mavic Air", "versions": [{"status": "affected", "version": "01.00.0500"}]}, {"vendor": "DJI", "modules": ["Telemetry Channel"], "product": "Mavic Mini", "versions": [{"status": "affected", "version": "01.00.0500"}]}]}], "published": "2025-09-11T12:15:33.677", "references": [{"url": "https://github.com/ByteMe1001/DJI-Enhanced-WiFi-Weak-Cryptography", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.323609", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.323609", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?submit.639757", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-320"}, {"lang": "en", "value": "CWE-321"}]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Executing manipulation can lead to use of hard-coded cryptographic key\r . The attacker needs to be present on the local network. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer."}, {"lang": "es", "value": "Se ha identificado una debilidad en DJI Mavic Spark, Mavic Air y Mavic Mini 01.00.0500. Afecta a una funci\u00f3n desconocida del componente Canal de Telemetr\u00eda. La ejecuci\u00f3n de una manipulaci\u00f3n puede llevar al uso de una clave criptogr\u00e1fica codificada de forma r\u00edgida. El atacante necesita estar presente en la red local. Un alto nivel de complejidad est\u00e1 asociado con este ataque. Se dice que la explotabilidad es dif\u00edcil. El exploit se ha puesto a disposici\u00f3n del p\u00fablico y podr\u00eda ser explotado. Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el mantenedor."}], "lastModified": "2026-10-18T21:10:00.120", "sourceIdentifier": "cna@vuldb.com"}