Medium severity · published Sep 11, 2025
CVE-2025-10250
DJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded key
5.0
CVSS
0.2%
EPSS
No
On KEV
Description
A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Executing manipulation can lead to use of hard-coded cryptographic key
. The attacker needs to be present on the local network. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mavic Air · DJI
01.00.0500 · source: vendor
MM
Mavic Mini · DJI
01.00.0500 · source: vendor
MS
Mavic Spark · DJI
01.00.0500 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10250
github.com
https://github.com/ByteMe1001/DJI-Enhanced-WiFi-Weak-Cryptography
vuldb.com
https://vuldb.com/?ctiid.323609
vuldb.com
https://vuldb.com/?id.323609
vuldb.com
https://vuldb.com/?submit.639757
