MAVLink without a seatbelt.

A field study of telemetry links across eleven commercial aircraft, and what it takes to fly one from the ground.

MAVLink is the lingua franca of small unmanned aircraft. It is also, in its default configuration, a protocol with no authentication, no encryption, and no replay protection. Message signing exists. Almost nobody turns it on.

Method

We acquired eleven commercially available aircraft across four price tiers, captured the telemetry link on the bench with a software-defined radio, and attempted three escalating actions: read telemetry, inject a benign parameter change, and inject a mode change.

• Capture: passive receive at the advertised link frequency, no association required on nine of eleven.
• Inject: craft a valid MAVLink frame with the observed system and component ID.
• Escalate: mode change to RTL, then to LOITER, then a waypoint upload.

Results

Nine of eleven aircraft accepted an injected mode change from an unassociated transmitter. Two rejected it — both had MAVLink 2 message signing enabled by default, and both were the two most expensive units in the study.

The failure is not in MAVLink. Signing has been in the specification since 2017. The failure is that it ships off, and the integration guides that OEMs follow do not turn it on.

What OEMs should do

• Enable MAVLink 2 message signing by default and fail closed when the peer does not sign.
• Provision the link key per aircraft at manufacture. Never derive it from a serial number.
• Rate-limit and log mode changes at the flight controller, not only at the ground station.
• Treat the telemetry radio as an untrusted network interface, because that is what it is.

Disclosure

All eleven vendors were contacted. Seven responded. Four have shipped firmware that enables signing by default. The aircraft are not named individually — this is a pattern in the ecosystem, not a story about one vendor.