CVE-2021-44320: Parrot AR.Drone DoS Vulnerability

CVE-2021-44320 Overview

CVE-2021-44320 is a denial-of-service (DoS) vulnerability affecting the Parrot AR.Drone versions 1 and 2. The device lacks a mechanism to throttle or filter high-volume IPv4 traffic, allowing attackers on the same network to disrupt drone operations. Verified attack techniques include TCP SYN flooding and UDP flooding, both of which degrade or halt video streaming and flight control channels. The weakness is categorized under [CWE-400] Uncontrolled Resource Consumption. Because the drone exposes control and telemetry services over its Wi-Fi interface, any client associated with the drone's access point can reach the vulnerable endpoints.

Critical Impact
Attackers with network reachability to the drone can disable video streaming and flight control, causing loss of operator visibility and potentially unsafe flight behavior.

Affected Products

Parrot AR.Drone version 1
Parrot AR.Drone version 2
Associated onboard control and video streaming services

Discovery Timeline

2026-09-04 - CVE-2021-44320 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2021-44320

Vulnerability Analysis

The Parrot AR.Drone exposes its command, telemetry, and video services over an unauthenticated Wi-Fi network. The onboard network stack does not implement rate limiting, connection throttling, or filtering for inbound IPv4 traffic. Attackers can therefore consume all available processing and bandwidth resources by generating large volumes of TCP SYN or UDP packets. The result is loss of video streaming and unresponsive flight controls while the flood is active.

The root weakness is uncontrolled resource consumption [CWE-400] within the embedded network stack. Researchers documented practical impact in ResearchGate publications on AR.Drone corruption and DoS attacks against the AR.Drone 2.0.

Root Cause

The drone's firmware processes inbound IPv4 packets without policing connection rates or half-open TCP sessions. SYN floods exhaust the TCP backlog, while UDP floods saturate the packet-processing loop that also services legitimate control and video traffic. No authentication or ACL protects these listeners.

Attack Vector

An attacker within Wi-Fi range associates with the AR.Drone's access point, which does not enforce credentials by default. From there, the attacker directs SYN or UDP floods at the drone's IP. A proof-of-concept demonstrating the flood is available in the GitHub PoC for CVE-2021-44320.

No verified code example is available for inclusion. See the ResearchGate Study on DoS Attacks Impact for measurement methodology and packet-rate thresholds.

Detection Methods for CVE-2021-44320

Indicators of Compromise

Sudden loss of video stream or telemetry from the drone during active flight
Unresponsive control commands while the drone remains associated with its access point
Abnormally high inbound packet rates observed on the drone's Wi-Fi interface

Detection Strategies

Monitor the drone's Wi-Fi channel for unauthorized clients associating with the AR.Drone SSID
Use a passive wireless sensor to detect elevated SYN or UDP packet volumes directed at the drone's IP
Correlate loss of video or control heartbeat with concurrent flood traffic observed on the same channel

Monitoring Recommendations

Log association events on the drone's access point and alert on unexpected clients
Baseline normal control and video packet rates so that deviations trigger operator alerts
Review ground-station logs after flights for gaps in telemetry that align with radio interference or flooding

How to Mitigate CVE-2021-44320

Immediate Actions Required

Operate the AR.Drone only in controlled environments free of untrusted Wi-Fi clients
Configure the drone's access point with WPA2 credentials where firmware supports it
Restrict physical and RF proximity of untrusted parties during flight operations

Patch Information

No vendor patch is referenced in the available advisory data for CVE-2021-44320. Operators should treat the AR.Drone versions 1 and 2 as end-of-life for security purposes and plan replacement or compensating controls. Consult the ResearchGate Publication on ARDrone Corruption for background on the exposed services.

Workarounds

Enable Wi-Fi encryption on the drone's access point if the firmware version allows it
Fly in geographically isolated areas to reduce the probability of an in-range attacker
Retire affected AR.Drone units in environments where a targeted DoS could cause safety or mission impact

bash

# No vendor configuration example is available for this CVE.
# Refer to the linked references for operator guidance.