Read the docs
TI-2020-08288 Aliases CVE-2020-10281GHSA-c598-6h34-q6qw

RVD#3315: Cleartext transmission of sensitive information in MAVLink protocol version 1.0 and 2.0

Priority LOW 34CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-319.

Summary

This vulnerability applies to the Micro Air Vehicle Link (MAVLink) protocol and allows a remote attacker to gain access to sensitive information provided it has access to the communication medium. MAVLink is a header-based protocol that does not perform encryption to improve transfer (and reception speed) and efficiency by design. The increasing popularity of the protocol (used accross different autopilots) has led to its use in wired and wireless mediums through insecure communication channels exposing sensitive information to a remote attacker with ability to intercept network traffic.

Why it matters now

EPSS 0.00727 54th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
unspecifiedMAVLinkup to v2.0—No fix listedCNA
  • MAVLink Vendorunspecified Affected up to v2.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dronecode:micro_air_vehicle_link:-:*:*:*:*:*:*:*not specified by NVDVulnerableDronecode
  • cpe:2.3:a:dronecode:micro_air_vehicle_link:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Dronecode

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10281
  2. 2026-10-03 Alias added: GHSA-c598-6h34-q6qw

References

Advisory 1

  • TI-2020-08289 RVD#3316: No authentication in MAVLink protocol CVSS 3.1CRITICAL 9.8
  • TI-2020-08290 RVD#3317: MAVLink version handshaking allows for an attacker to bypass authentication CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences