LC-2 · Software Danger Reports

LrrK Kinematic Software Danger Report

# LrrK Kinematic Software Danger Report

**LRRK Watch / Software Assurance** — Monthly filing.

| Field | Value |
| --- | --- |
| Collection cutoff | 30 September 2025 |
| Platform | Quiet Systems |
| Series | DKSR-M-2025-09 |
| Status | short |
| Data label | Open-source intelligence // LRRK analytic product |
| Handling | Public-source material. Retrospective monthly. Image rights require separate verification before publication. |

## Executive read

### BLUF

Legacy DJI Enhanced-WiFi telemetry gets a hard-coded key CVE. Products are unsupported. CVE says an exploit was made public; this filing does not reproduce it.

### Key judgments

1. **[Assessment — High confidence]** CVE-2025-10250, NVD 11 September 2025, firmware 01.00.0500 on Spark / Mavic Air / Mavic Mini.
2. **[Assessment — High confidence]** Patch: none — products no longer supported.
3. **[Uncertainty]** Exploit quality is VulDB wording only.

### Analytic labels

- **Fact** — verified reporting or primary record
- **Assessment** — analytic judgment
- **Inference** — reasoned but not directly observed
- **Uncertainty** — unresolved information gap

### Source grades

- **A1** — authoritative primary record / directly confirmed
- **B1–B2** — generally reliable and corroborated
- **C3** — useful but requires caution

## 01. CVE-2025-10250: DJI Enhanced-WiFi hard-coded telemetry key

*Event / publication dates: NVD 11 September 2025*

| Field | Value |
| --- | --- |
| Component | firmware |
| Product | DJI Spark, Mavic Air, Mavic Mini firmware 01.00.0500 (unsupported) |
| CVE / advisory | CVE-2025-10250 |
| Patch | none |
| Exploit status | catalogued; CVE states an exploit has been made public |
| Taxonomy | CWE-320 · CWE-321 (CNA) · CAPEC-115 · ATT&CK ICS T0860 · OWASP IoT I1 |

**Verified record — [Fact — A1] https://nvd.nist.gov/vuln/detail/CVE-2025-10250 · https://github.com/advisories/GHSA-58j3-q2f3-hh75**

**Exposure.** Telemetry crypto on leftover Enhanced-WiFi airframes. Local-network, high complexity.

**Intelligence assessment.** [Assessment — High confidence] Legacy fleet, not current OcuSync. [Inference — Moderate confidence] Sibling pairing/DoS IDs arrive in 2026-02 and 2026-03.

**Opportunity.** Passport Enhanced-WiFi vs OcuSync as different radios. Do not treat this as a Matrice/Mavic 3 case.

**LRRK relevance.** Control Fabric on leftover SKUs. Watch, do not inflate.

**Confidence.** High on CVE/date. Moderate on exploit quality.

## Forward indicators

1. CVE-2026-1743 pairing replay (February 2026).
2. CVE-2026-26673 Enhanced-WiFi DoS (March 2026).

> **Collection integrity.** Status only. No exploit steps. No how-to from the public repo.

*LRRK — security assurance for systems that sense, move, and act.*

<p align="right"><span style="opacity:0.35;letter-spacing:0.18em;font-size:0.8em">L-C2</span></p>