CVE-2020-10283

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Micro Air Vehicle Link (MAVLink) protocol presents authentication mechanisms on its version 2.0 however according to its documentation, in order to maintain backwards compatibility, GCS and autopilot negotiate the version via the AUTOPILOT_VERSION message. Since this negotiation depends on the answer, an attacker may craft packages in a way that hints the autopilot to adopt version 1.0 of MAVLink for the communication. Given the lack of authentication capabilities in such version of MAVLink (refer to CVE-2020-10282), attackers may use this method to bypass authentication capabilities and interact with the autopilot directly.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

No affected versions have been published.

Timeline

Published
Aug 20, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-102849.1No authentication is required to control the robot inside the network, moreso the latest available user manual shows an option that lets theCVE-2020-102859.8The authentication implementation on the xArm controller has very low entropy, making it vulnerable to a brute-force attack. There is no mecCVE-2020-102868.8the main user account has restricted privileges but is in the sudoers group and there is not any mechanism in place to prevent sudo su or suCVE-2020-102879.8The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers thCVE-2020-102889.8IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however youCVE-2020-102898.8Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happCVE-2020-10297.8An elevation of privilege vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations, akaCVE-2020-102906.8Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide ACVE-2020-102917.5Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decisioCVE-2020-102928.2Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decisioCVE-2020-10307.8<p>An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file sysCVE-2020-10317.5<p>An information disclosure vulnerability exists in the way that the Windows Server DHCP service improperly discloses the contents of its m