PT-2025-37174 · Dji · Mavic Air+2

Byteme1001 · Published 2025-09-11 · Updated 2025-09-11 · CVE-2025-10250

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: DJI Mavic Spark version 01.00.0500 DJI Mavic Air version 01.00.0500 DJI Mavic Mini version 01.00.0500

Description: A weakness exists in the Telemetry Channel component due to the use of a hard-coded cryptographic key. An attacker present on the local network can exploit this issue. The exploitability is considered difficult and the exploit has been publicly released. This vulnerability only affects products that are no longer supported.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-321

CWE-320

Related Identifiers

CVE-2025-10250

Affected Products

Mavic Air

Mavic Mini

Mavic Spark

References · 6

• 🔥 https://github.com/ByteMe1001/DJI-Enhanced-WiFi-Weak-Cryptography · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10250 · Security Note
• https://vuldb.com/?ctiid.323609 · Note
• https://vuldb.com/?id.323609 · Note
• https://twitter.com/VulmonFeeds/status/1966201327073067389 · Twitter Post
• https://vuldb.com/?submit.639757 · Note