CVE-2025-10250 Overview
CVE-2025-10250 affects the Telemetry Channel component in DJI Mavic Spark, Mavic Air, and Mavic Mini drones running firmware 01.00.0500. The weakness stems from the use of a hard-coded cryptographic key [CWE-320] in the enhanced Wi-Fi protocol used to transmit telemetry data between the drone and controller. An attacker on the adjacent wireless network can leverage the embedded key to decrypt or manipulate telemetry traffic. The affected products are no longer supported by the vendor, so no official patch is expected. A proof-of-concept exploit is publicly available on GitHub, increasing the risk of opportunistic abuse against legacy fleets still in operation.
Critical Impact
An attacker within wireless range can decrypt DJI drone telemetry traffic using a static cryptographic key embedded in the firmware, exposing flight data and control messages.
Affected Products
- DJI Mavic Spark firmware 01.00.0500
- DJI Mavic Air firmware 01.00.0500
- DJI Mavic Mini firmware 01.00.0500
Discovery Timeline
- 2025-09-11 - CVE-2025-10250 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10250
Vulnerability Analysis
The vulnerability resides in the Telemetry Channel of the enhanced Wi-Fi link that DJI Mavic Spark, Air, and Mini drones use to communicate with their controllers. The firmware embeds a static cryptographic key that is reused across every device of the affected models. Because the key is not derived from a session secret or per-device material, any attacker who extracts it from one firmware image can reuse it against every drone on the same network segment. The exploitation path requires radio proximity to the drone or controller and the ability to capture the wireless frames carrying telemetry data.
Root Cause
The root cause is categorized under [CWE-320] Key Management Errors. The firmware ships with a hard-coded symmetric key used to protect telemetry traffic. The protocol lacks a session key exchange or per-flight key derivation step. Once the embedded key is recovered through firmware analysis, the cryptographic protection of the channel is effectively void for all affected devices.
Attack Vector
Exploitation requires attacker presence on the adjacent wireless network used by the drone and controller. The attacker captures encrypted telemetry frames and decrypts them with the recovered static key. This exposes flight position, sensor readings, and control messages. Attack complexity is high because the attacker must be in radio range, synchronize with the enhanced Wi-Fi link, and process the proprietary frame format. A public proof-of-concept is hosted at the DJI Enhanced WiFi Weak Cryptography repository.
See the VulDB entry #323609 for additional technical context on the vulnerability.
Detection Methods for CVE-2025-10250
Indicators of Compromise
- Unexpected wireless clients associating with the enhanced Wi-Fi link between drone and controller.
- Unusual packet capture activity or monitor-mode wireless adapters observed near drone operations.
- Telemetry sessions showing frame injection, duplication, or out-of-sequence sequence numbers.
Detection Strategies
- Monitor the 2.4 GHz and 5 GHz spectrum around drone operations for unauthorized wireless sniffers and rogue access points.
- Baseline normal drone-to-controller traffic patterns and alert on anomalies in frame rate, size, or source MAC addresses.
- Correlate physical observations of unknown personnel with wireless anomalies during flight operations.
Monitoring Recommendations
- Deploy wireless intrusion detection in facilities where legacy DJI drones remain in service.
- Log drone firmware versions in asset inventory to identify systems running the vulnerable 01.00.0500 build.
- Track public references such as VulDB CTI #323609 for updates to exploit tooling.
How to Mitigate CVE-2025-10250
Immediate Actions Required
- Inventory DJI Mavic Spark, Air, and Mini devices and identify units running firmware 01.00.0500.
- Restrict drone operations to controlled areas where adjacent wireless attackers are unlikely to be present.
- Treat telemetry data from affected drones as untrusted and avoid relying on it for sensitive operations.
Patch Information
The affected products are no longer supported by DJI, and no vendor patch is available for this vulnerability. Operators should plan migration to supported drone platforms that implement per-session key derivation for telemetry traffic.
Workarounds
- Retire affected drones from missions involving sensitive flight paths or data.
- Operate affected devices only in environments where wireless eavesdropping can be physically controlled.
- Avoid flying affected models in dense urban areas or near untrusted wireless infrastructure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
