CVE-2020-10283 RVD#3317: MAVLink version handshaking allows for an attacker to bypass authentication

What is CVE-2020-10283?

CVE-2020-10283 is a high-severity vulnerability in PX4 MAVLink, published on 20 Aug 2020.

Official description

The Micro Air Vehicle Link (MAVLink) protocol presents authentication mechanisms on its version 2.0 however according to its documentation, in order to maintain backwards compatibility, GCS and autopilot negotiate the version via the AUTOPILOT_VERSION message. Since this negotiation depends on the answer, an attacker may craft packages in a way that hints the autopilot to adopt version 1.0 of MAVLink for the communication. Given the lack of authentication capabilities in such version of MAVLink (refer to CVE-2020-10282), attackers may use this method to bypass authentication capabilities and interact with the autopilot directly.

Weakness: CWE-288

Which versions are affected by CVE-2020-10283?

It affects 1 product.

Products include Dronecode Micro Air Vehicle Link.

How do I fix CVE-2020-10283?

No fix has been published for CVE-2020-10283 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-10283 being exploited?

There is no known exploitation of CVE-2020-10283 in the wild and no public exploit code.

Other vulnerabilities in PX4 MAVLink

• CVE-2020-10282 RVD#3316: No authentication in MAVLink protocol Critical 9.8
• CVE-2020-10281 RVD#3315: Cleartext transmission of sensitive information in MAVLink protocol version 1.0 and 2.0 High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p772-7p8w-gc5x.