CVE-2020-10282— Micro Air Vehicle Link 访问控制错误漏洞

RVD#3316: No authentication in MAVLink protocol

The Micro Air Vehicle Link (MAVLink) protocol presents no authentication mechanism on its version 1.0 (nor authorization) whichs leads to a variety of attacks including identity spoofing, unauthorized access, PITM attacks and more. According to literature, version 2.0 optionally allows for package signing which mitigates this flaw. Another source mentions that MAVLink 2.0 only provides a simple authentication system based on HMAC. This implies that the flying system overall should add the same symmetric key into all devices of network. If not the case, this may cause a security issue, that if one of the devices and its symmetric key are compromised, the whole authentication system is not reliable.

N/A

关键功能的认证机制缺失

Micro Air Vehicle Link 访问控制错误漏洞

Micro Air Vehicle Link（MAVLink）是Dronecode项目的一款轻量级的消息传输协议，它主要用于地面控制终端（地面站）与无人机之间 (以及机载无人机组件之间) 的通信。 MAVLink中存在访问控制错误漏洞，该漏洞源于程序没有提供任何身份验证（授权）机制。攻击者可利用该漏洞进行身份欺骗、未授权访问、PITM攻击等。

N/A

N/A