Drone security: critical threats and how to protect airspace in 2025

By Kike Gandia · Drones & Defense · 10 min read

Commercial drones have become one of the most neglected attack surfaces in modern cybersecurity. With 16 critical vulnerabilities documented in DJI's most popular models alone and a market set to reach $93.78 billion by 2033, securing these flying platforms is no longer optional: it is imperative. This analysis takes a close look at current threats, the detection systems available, the European regulatory framework and best practices for organizations that operate drones or protect infrastructure against UAV risks.

The threat landscape has changed dramatically. Drones are no longer just recreational toys or aerial photography tools; they have become sophisticated attack vectors capable of breaching corporate networks, conducting unauthorized surveillance, smuggling contraband into prisons or shutting down international airports for hours. The 2018 Gatwick incident cost more than £50 million and affected 140,000 passengers. Since then, incidents have grown exponentially: the NFL reported a 4,145% increase in drone incursions over stadiums between 2018 and 2023.

16: critical vulnerabilities documented (in the most popular DJI models alone)
$93.78B: projected drone market size by 2033
£50M: cost of the 2018 Gatwick incident (140,000 passengers affected)
+4,145%: rise in stadium incursions between 2018 and 2023 (according to the NFL)

Documented vulnerabilities in DJI and Parrot drones reveal systemic flaws

Research by Nozomi Networks Labs published in April 2024 identified nine critical CVEs affecting the DJI Mavic 3, Mini 3 Pro and Matrice series. CVE-2023-6951 exposes a fundamental weakness: the WPA2 Wi-Fi passwords these drones generate use only 8 hexadecimal characters, so they can be cracked in roughly 2–4 hours with an Nvidia T4 GPU and Hashcat. Although rated medium severity (CVSS 6.6), this vulnerability is a trivial way in for a sufficiently motivated attacker.

More worrying are the out-of-bounds write vulnerabilities (CVE-2023-51454 and CVE-2023-51455), which can potentially lead to remote code execution. The vtwo_sdk service, exposed on port 10000, offers multiple attack vectors, from denial of service via malformed packets to buffer overflows that fully compromise the device. Research by Ruhr University Bochum presented at the NDSS Symposium 2023 showed that fuzzing the DUML (DJI Universal Markup Language) protocol made it possible to change serial numbers, tamper with flight logs and, critically, bypass the geofencing that prevents flights over airports, prisons and sensitive facilities.

Parrot is not immune either. CVE-2024-33844 affects firmware 1.10.4 on the ANAFI USA, allowing attackers to cut communication between the controller and the drone through a flaw in the MAV_MISSION_TYPE handling. Earlier vulnerabilities such as CVE-2019-3944 showed that these drones are susceptible to Wi-Fi deauthentication attacks that can bring the aircraft down mid-flight.

CVE-2023-6951 8-character Wi-Fi passwords: The WPA2 passwords these drones generate use only 8 hexadecimal characters: they can be cracked in 2–4 hours with an Nvidia T4 GPU and Hashcat. Medium severity (CVSS 6.6), but a trivial way in.
CVE-2023-51454 / 51455 Out-of-bounds write: Potentially allow remote code execution. The vtwo_sdk service, exposed on port 10000, ranges from denial of service via malformed packets to buffer overflows that compromise the entire device.
DUML protocol Geofencing bypass: Fuzzing the protocol made it possible to change serial numbers, tamper with flight logs and get around the restriction that prevents flights over airports, prisons and sensitive facilities. Ruhr University Bochum, NDSS 2023.
CVE-2024-33844 Parrot ANAFI USA: In firmware 1.10.4, a flaw in MAV_MISSION_TYPE cuts communication between the controller and the drone.
CVE-2022-29945 Unencrypted DroneID: For years, DJI telemetry broadcast the operator's exact location without cryptographic protection (CVSS 7.5). It was used to locate operators for mortar strikes in Ukraine. DJI began encrypting it in 2024, but millions of vulnerable devices are still in service.

The documented vulnerabilities covered in this article, with their identifier and their impact.

Attack vectors: from GPS spoofing to corporate hijacking

Attack vectors against drones fall into several categories, each with different operational implications. GPS spoofing has grown at an alarming rate: according to the Stanford GPS Lab, flights affected by this kind of attack rose from 300 a day in January 2024 to 1,500 a day in August of the same year, mainly in conflict zones such as Ukraine and the Black Sea. The civilian GPS signal has no encryption or authentication, so attackers with off-the-shelf SDR hardware (available for $300–500) can inject fake signals that divert the drone from its course or knock out its navigation entirely.

January 2024 Flights affected by GPS spoofing per day.	300 flights/day
August 2024 Five times as many in seven months, mostly over Ukraine and the Black Sea.	1,500 flights/day

Data from the Stanford GPS Lab. Civilian GPS has no encryption or authentication, and the SDR hardware needed to inject fake signals costs between $300 and $500.

Hijacking is the most direct threat. In October 2022, a US financial services firm was breached by modified DJI drones that landed on its roof and deployed Wi-Fi Pineapple devices to capture network credentials. The case, documented by researcher Greg Linares, shows how drones have become launch platforms for close-access attacks that bypass traditional security perimeters.

The MAVLink protocol, the de facto standard for communication between a UAV and its ground control station, has serious structural weaknesses. By default, messages are sent in plaintext with no authentication. Although MAVLink 2.0 introduces optional SHA-256 packet signing, the feature is rarely implemented and the shared key is exchanged in plaintext during the initial connection. Academic papers such as “MAVSec” (2019) and “MAVShield” (2025) propose ChaCha20 encryption schemes, but adoption in commercial devices remains limited.

For years, the unencrypted telemetry of DJI's DroneID/AeroScope system broadcast the operator's exact location without any cryptographic protection. According to the Ukrainian government, this vulnerability (CVE-2022-29945, CVSS 7.5) was used during the Russia-Ukraine war to locate drone operators for mortar strikes. DJI began rolling out encryption in 2024, but millions of vulnerable devices are still in service.

DJI AeroScope and counter-UAS detection technologies

The drone detection ecosystem has matured considerably, with DJI AeroScope established as the reference for monitoring drones from the Chinese manufacturer (which controls 70–83% of the market, depending on the source). AeroScope is a passive receiver that demodulates the RF signals between the drone and its controller and extracts real-time telemetry: serial number, the drone's GPS position, the pilot's location, speed, heading and full flight path. The stationary version reaches up to 50 km in ideal conditions, with identification in just 2 seconds.

AeroScope does, however, have critical limitations. It only detects DJI drones manufactured after 2014, leaving out other manufacturers, DIY drones and pre-programmed autonomous aircraft. The signals were not encrypted until 2024, which opened the door to spoofing, with attackers able to forge location data. From a legal standpoint, its use by private entities in the United States raises potential violations of federal surveillance laws.

Remote ID is the emerging standard for drone identification. The European standard EN 4709-002 and the US standard ASTM F3411 require drones to broadcast their identifiers, drone position, operator position and emergency status over Bluetooth LE or Wi-Fi. Since January 1, 2024 in Europe and March 16, 2024 in the United States, compliance has been mandatory for drones with class markings C1, C2, C3, C5 and C6. Detection range varies from 300 meters (Bluetooth Legacy) to 3 km (Bluetooth 5.0 Long Range).

Commercial counter-UAS solutions combine multiple technologies in defense-in-depth architectures:

1–5 km RF detection: Passive sensors that pick up drone-to-controller communication and locate the pilot by triangulation, without emitting any signal. Ineffective against autonomous drones with no radio link.
12 km Radar: Systems such as Robin Radar IRIS, with micro-Doppler that tells rotors apart from birds. Signature analysis with deep neural networks cuts false positives in urban environments.
100–500 m Acoustic detection: AI-driven microphone arrays that capture the acoustic signature of the propellers. They work even against DIY drones with no known RF signature, but degrade with ambient noise.
Verification Optical systems: EO/IR cameras with computer vision for visual confirmation and forensic evidence capture.

The four layers that commercial counter-UAS solutions combine. None of them is enough on its own.

Vendors such as DroneShield (Australia), Dedrone (acquired by Axon in October 2024), Fortem Technologies and Robin Radar Systems lead the market. DroneShield's range runs from the DroneGun Mk4 rifle-style jammer to the integrated, AI/ML-driven DroneSentry system. Fortem stands out for its autonomous DroneHunter F700 interceptor, the only one authorized for drone-on-drone capture in US airspace, with more than 5,000 documented captures, including military drones such as the Shahed-136.

DJI AeroScope what it provides

Passive receiver that demodulates the RF signals between drone and controller.
Extracts serial number, GPS position, pilot location, speed, heading and full flight path.
Up to 50 km in ideal conditions, with identification in 2 seconds.

Its limits what it does not cover

Only detects DJI drones manufactured after 2014.
Other manufacturers, DIY drones and pre-programmed autonomous aircraft are left out.
The signals were not encrypted until 2024: an attacker could forge location data.
Its use by private entities in the US raises potential violations of federal surveillance laws.

The European regulatory framework: navigating EASA, Remote ID and ETSI EN 303 645

Regulation (EU) 2019/947 sets out three risk-based operational categories: Open (low risk, no prior authorization, MTOM under 25 kg, maximum height 120 m), Specific (medium risk, requires a declaration or an authorization based on a SORA assessment) and Certified (high risk, full certification for carrying people or dangerous goods). Since January 1, 2024, drones with CE class markings C1–C3, C5 and C6 must have Remote ID built in.

In Spain, Royal Decree 517/2024 (in force since June 2024) designates ENAIRE as the sole provider of information on UAS geographical zones. Articles 38–41 set out specific restrictions: 25 meters horizontally and 50 meters vertically from critical infrastructure, mandatory notification to the Ministry of the Interior 5 days in advance for urban flights, and a mandatory check of the ENAIRE Drones app before every operation.

The ETSI EN 303 645 standard (version 3.1.3, September 2024) sets out 13 cybersecurity categories that apply to drones as connected IoT devices: no universal default passwords, vulnerability disclosure management, secure software updates, encrypted credential storage, secure communications (appropriate encryption), minimized exposed attack surface, secure boot for firmware integrity, personal data protection and input data validation. Although it cannot be adopted directly as a Harmonized Standard, it will inform future regulation under the Cyber Resilience Act (fully applicable from December 2027).

The NIS2 Directive affects drone operations in essential sectors (energy, transport, digital infrastructure, public administration), requiring cybersecurity risk assessments, third-party management for drone hardware and software, and incident reporting within 24–72 hours.

Open Low risk: No prior authorization, MTOM under 25 kg and a maximum height of 120 m.
Specific Medium risk: Requires a declaration or an authorization based on a SORA assessment.
Certified High risk: Full certification for carrying people or dangerous goods.
Spain · RD 517/2024 Specific restrictions: 25 m horizontally and 50 m vertically from critical infrastructure, notification to the Ministry of the Interior 5 days in advance for urban flights, and a mandatory check of the ENAIRE Drones app before every operation.

The three risk-based categories of Regulation (EU) 2019/947, plus what the Spanish rules add.

The counter-UAS market will grow to $11.12 billion by 2030

Market figures show the scale of the challenge. The commercial drone market reached $30.02 billion in 2024 according to Grand View Research, with a projected $54.64 billion by 2030 (10.6% CAGR). DJI dominates with a 70–83% share according to Dedrone, followed at a distance by Autel Robotics (1.4%) and Parrot (under 2%).

The counter-UAS market is growing explosively: from $2.7 billion in 2024 to a projected $11.12 billion by 2030 (26.57% CAGR according to MarketsandMarkets). Detection accounts for 55% of the market, with defense and military absorbing 44.56% of deployments. The Pentagon allocated $1.3 billion in 2025 to counter-UAS capabilities, while the EU is putting €200 million into innovation in this area through Horizon Europe.

$30.02B: commercial drone market in 2024 ($54.64B projected for 2030)
70–83%: market share held by DJI (Autel Robotics 1.4%, Parrot under 2%)
$2.7B → $11.12B: counter-UAS market growth to 2030 (26.57% CAGR)
$1.3B: allocated by the Pentagon in 2025 to counter-UAS capabilities

Documented incidents justify these investments. In September 2025, Copenhagen airport was shut for almost 4 hours, with 77 cancellations and 217 delays. The trend in prisons is just as alarming: the US federal system recorded 479 incidents in 2024, compared with just 23 in 2018; England and Wales reported 1,712 incidents in the 2024–2025 financial year, a 43% increase. Operation Skyhawk in Georgia led to 150 arrests and the seizure of more than 50 drones used to smuggle contraband worth more than $7 million.

Sept. 2025 Copenhagen airport: Shut for almost 4 hours, with 77 cancellations and 217 delays.
23 → 479 US federal prisons: Incidents recorded in 2018 versus 2024.
+43% England and Wales: 1,712 incidents in the 2024–2025 financial year.
Georgia Operation Skyhawk: 150 arrests and more than 50 drones seized, with contraband worth more than $7 million.

The documented incidents that justify investment in counter-UAS.

Security research: from academic paper to exploit in the wild

The security research community has built up a solid body of knowledge on drone vulnerabilities. The paper “Drone Security and the Mysterious Case of DJI's DroneID” (NDSS 2023), by researchers at Ruhr University Bochum and the CISPA Helmholtz Center, documented DUML protocol fuzzing methodologies that uncovered 16 exploitable vulnerabilities. Work such as “MAVSec” proposes ChaCha20 encryption for MAVLink, while “MUVIDS” (NDSS AutoSec 2021) develops LSTM-based detection to spot malicious MAVLink packet injection.

Conferences such as DEF CON and Black Hat serve as disclosure platforms. At DEF CON 24, Aaron Luo demonstrated real-time hijacking of a DJI Phantom 3, taking full control of the drone from a keyboard. Black Hat Europe Arsenal 2019 introduced DroneSploit, an open-source, Metasploit-style framework for pentesting Wi-Fi-controlled drones. The Damn Vulnerable Drone simulator lets you practice attacks in a safe environment using ArduPilot and MAVLink.

Tools such as Samy Kamkar's SkyJack turn a Parrot AR.Drone into an autonomous platform that seeks out, hacks and takes over other drones using a Raspberry Pi and Wi-Fi hardware. For communications analysis, SDR devices such as the HackRF One (100 kHz–6 GHz, roughly $300–400) can intercept control signals, carry out GPS spoofing in lab environments and decode telemetry. DJI's bug bounty program has paid out roughly $75,000 for some 200 vulnerabilities reported by 87 researchers. Rewards range from $50 to $30,000 depending on severity, although the program has drawn criticism for poor communication and for disputes with researchers such as Kevin Finisterre of Department 13.

Security recommendations for operators and critical infrastructure

Effective protection against drone threats calls for a layered approach that combines detection, mitigation and regulatory compliance. For drone operators, the priorities are updating firmware to the latest versions immediately (patching known CVEs), setting strong Wi-Fi passwords instead of the generated defaults, encrypting communications wherever possible and adopting Zero Trust architectures for sensitive operations.

Critical infrastructure operators should deploy layered detection that combines RF, radar and optical sensors for maximum coverage. The ability to locate the pilot (RF triangulation or AeroScope) is critical for the physical security response. Integration with incident management systems enables a coordinated response, while regular vulnerability assessments identify gaps before they are exploited.

From a compliance standpoint, organizations should map their obligations under the EASA Open/Specific/Certified categories, meet Remote ID requirements, assess whether ETSI EN 303 645 applies to corporate IoT drones and consider the NIS2 implications for essential sectors.

Low-altitude airspace has become a new cybersecurity domain. Organizations that understand these threats and address them proactively will be better placed to protect their assets, comply with emerging regulation and take advantage of what commercial drones have to offer, without taking on unnecessary risk along the way.

Related service

Adversary simulation and red teaming

Topics

#Cybersecurity #Drone #Drone-Warfare #Drones #Drones-and-Missiles #Hacking-Hardware

Keep reading

Talk to the team