PT-2024-25506 · Parrot · Parrot Anafi Usa

Entropy1110 · Published 2024-05-03 · Updated 2024-12-18 · CVE-2024-33844

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Parrot ANAFI USA firmware version 1.10.4

Description The issue concerns a lack of validation for the MAV MISSION TYPE in the Parrot ANAFI USA firmware, specifically for values 0, 1, 2, and 255. This allows an attacker to disrupt the connection between the controller and the drone by sending a MAVLink MISSION COUNT command with an incorrect MAV MISSION TYPE. This can be exploited via a local network.

Recommendations For Parrot ANAFI USA firmware version 1.10.4, consider isolating drones from the network and analyzing traffic to minimize the risk of exploitation. As a temporary workaround, restrict access to the MAVLink component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2024-33844

Affected Products

Parrot Anafi Usa

References · 10

• https://osv.dev/vulnerability/CVE-2024-33844 · Vendor Advisory
• https://forum.developer.parrot.com/t/cve-2024-33844-bugs-in-anafi-thermal-usa-firmware/22501/1 · Vendor Advisory
• https://forum.developer.parrot.com/t/cve-2024-33844-bugs-in-anafi-thermal-usa-firmware/22501 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-33844 · Security Note
• http://nvd-cwe-other.com · Note
• https://twitter.com/oktsec/status/1786463953092039129 · Twitter Post
• https://t.me/cvenotify/89456 · Telegram Post
• https://t.me/cvenotify/82635 · Telegram Post
• http://anafi.com · Note
• https://twitter.com/giammaiot2/status/1869526752781046027 · Twitter Post