Vulnerability · Published Sep 11, 2025 · Assigned by VulDB

CVE-2025-10250DJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded key

Medium 5.0

In plain English

A medium-severity security flaw in Mavic Air from DJI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.2%top 83.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Executing manipulation can lead to use of hard-coded cryptographic key . The attacker needs to be present on the local network. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer.

Affected products (as reported)

Vendor	Product	Versions
DJI	Mavic Spark	01.00.0500
DJI	Mavic Air	01.00.0500
DJI	Mavic Mini	01.00.0500

Weakness: CWE-321, CWE-320 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-323609 | DJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded key vdb-entry
VDB-323609 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
Submit #639757 | DJI DJI Mavic Mini 01.00.0500 Cryptographic Issues third-party-advisory
https://github.com/ByteMe1001/DJI-Enhanced-WiFi-Weak-Cryptography exploit