CVE-2023-50121

Vulnerability

A denial-of-service (DoS) vulnerability exists in Autel EVO NANO drone flight control firmware version 1.6.5. When the drone approaches the edge of a no-fly zone, the firmware triggers an unintended state that makes the drone completely immobile, except for vertical descent. The condition is reachable during normal operation when the drone enters a no-fly zone boundary, even if the operator is following all rules [1].

Exploitation

An attacker can exploit this vulnerability by causing the drone to be flown (or taken off) at the edge of a no-fly zone. The drone's flight control system then enters a forced descent mode without any warning to the operator. No authentication or special access is required; the exploit occurs automatically based on GPS position relative to no-fly zone boundaries [1].

Impact

Successful exploitation results in a denial of service: the drone loses all horizontal movement capability and can only descend vertically at its current position. This can force the drone to land in hazardous areas such as water, trees, or crowds, potentially causing damage, injury, or loss of the drone [1].

Mitigation

No fix or updated firmware version has been announced by Autel as of the publication date. The device remains vulnerable until a patch is released. Users should avoid flying near no-fly zone edges and consider disabling no-fly zone enforcement if legally permissible, though this is not a recommended workaround [1].