CVE-2021-44319: Parrot AR.Drone Wi-Fi Denial of Service

CVE-2021-44319 Overview

CVE-2021-44319 affects the Parrot AR.Drone 1 and AR.Drone 2 platforms. The drones are vulnerable to a Wi-Fi deauthentication attack that disconnects them from their controller during flight. Remote and unauthenticated attackers can transmit crafted 802.11 deauthentication frames to sever the control link. The issue is classified under [CWE-400] Uncontrolled Resource Consumption and results in a denial of service condition. Because the drone loses its control channel mid-flight, the impact extends beyond service availability to physical safety. The vulnerability was published to the National Vulnerability Database (NVD) on 2026-09-04.

Critical Impact
Attackers within Wi-Fi range can force the Parrot AR.Drone to disconnect from its operator during flight, causing loss of control and potential physical damage.

Affected Products

Parrot AR.Drone 1
Parrot AR.Drone 2
Parrot AR.Drone Wi-Fi control link (802.11 stack)

Discovery Timeline

2026-09-04 - CVE-2021-44319 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2021-44319

Vulnerability Analysis

The Parrot AR.Drone uses an open Wi-Fi network to establish command and control between the drone and the operator's device. The platform relies on IEEE 802.11 management frames that are transmitted unauthenticated and unencrypted by design. An attacker within radio range can inject spoofed deauthentication frames that appear to originate from either the drone or the controller. The receiving station honors the frame and tears down the association, cutting the control channel mid-flight. Because the deauthentication process consumes the finite radio association state without validation, the flaw maps to uncontrolled resource consumption under [CWE-400]. The vulnerability requires no credentials, no user interaction, and no prior access to the drone's network.

Root Cause

The root cause is the absence of Management Frame Protection (MFP, defined in IEEE 802.11w) on the drone's Wi-Fi interface. Without MFP, deauthentication and disassociation frames are not cryptographically authenticated. Any station in range can forge them using the drone's or controller's Media Access Control (MAC) address.

Attack Vector

An attacker positions a Wi-Fi adapter within range of the drone's SSID. Using standard tools such as aireplay-ng in deauthentication mode, the attacker transmits forged 802.11 deauth frames targeting the controller-to-drone association. Repeated frames prevent the controller from re-associating, keeping the drone offline until it lands, drifts, or crashes. See the Bertoli Tech DoS Attack Analysis and the GitHub CVE-2021-44319 Repository for technical details.

// No verified exploit code is republished here.
// Refer to the linked references for the documented proof-of-concept workflow.

Detection Methods for CVE-2021-44319

Indicators of Compromise

Bursts of 802.11 deauthentication or disassociation frames targeting the drone's MAC address or SSID.
Repeated unexpected disconnections between the AR.Drone and its controller during operation.
Presence of unknown Wi-Fi stations transmitting management frames on the drone's channel.

Detection Strategies

Deploy a wireless intrusion detection system (WIDS) that flags high-volume deauthentication frames on channels used by the drone.
Correlate frame counts with source MAC addresses to identify spoofed transmissions that impersonate the drone or controller.
Capture traffic with tcpdump or airodump-ng and alert on deauth-to-data-frame ratios that exceed a baseline.

Monitoring Recommendations

Continuously monitor the RF spectrum around drone operations for rogue stations and abnormal management-frame activity.
Log operator-side telemetry for link-loss events and correlate with wireless capture data.
Track the drone's channel and SSID visibility to detect nearby jammers or deauthers before flight.

How to Mitigate CVE-2021-44319

Immediate Actions Required

Avoid operating the AR.Drone in environments where hostile Wi-Fi activity is likely, including public venues and densely populated areas.
Maintain visual line of sight so the operator can manually recover the aircraft if the control link drops.
Restrict flights to controlled RF environments where 802.11 traffic can be monitored.

Patch Information

No vendor patch is referenced in the CVE record. The Parrot AR.Drone 1 and AR.Drone 2 are legacy consumer products, and the underlying weakness stems from the use of unauthenticated 802.11 management frames on an open Wi-Fi network. Operators should treat the platform as unsuitable for security-sensitive missions and consider migration to platforms that support authenticated command-and-control links.

Workarounds

Operate only in RF-controlled environments where unauthorized Wi-Fi transmitters can be detected and removed.
Change the default SSID and reduce transmit visibility to lower the chance of opportunistic targeting.
Preconfigure automatic landing behavior so the drone descends safely when the control link is lost.
Retire the platform from missions that require reliable command and control.

bash

# Example: monitor for deauthentication frames on the drone's channel
airmon-ng start wlan0
airodump-ng --band g --channel 6 wlan0mon
# Filter deauth frames in a capture for post-incident analysis
tcpdump -i wlan0mon -nn 'wlan type mgt and wlan subtype deauth'