Ghost Robotics Vision 60 MAVLink Command Injection Vulnerability Allowing Unauthorized Control

A vulnerability in the communication protocol of Ghost Robotics Vision 60, version 0.27.2, could enable an attacker to gain unauthorized full control of the robot. This is achieved by sending commands from an external attack station, impersonating the control station (tablet). The vulnerability arises from the lack of encryption and authentication in the communication protocol, which is based on MAVLink. This flaw allows attackers to capture and replicate legitimate traffic between the robot and the controller, sending any valid command from an attacking device. The robot can be connected remotely via Wi-Fi or 4G/LTE.

Impact

Exploitation of this vulnerability allows for unauthorized control of the robot, potentially leading to physical damage to the robot or its environment.