The vulnerability in Parrot ANAFI USA firmware 1.10.4 stems from the lack of validation of the MAV_MISSION_TYPE parameter in MAVLink MISSION_COUNT commands. Specifically, the control logic does not check if the MAV_MISSION_TYPE is one of the expected values (0, 1, 2, 255). An attacker can exploit this by sending a MISSION_COUNT command with an incorrect MAV_MISSION_TYPE, resulting in the disconnection of the controller from the drone. This issue is classified under CWE-404 (Improper Resource Shutdown or Release). No official patch or remediation guidance has been published as of the date of this report.

Successful exploitation results in denial of service by severing the communication link between the drone and its controller. This could disrupt drone operations and potentially cause loss of control. There is no indication of confidentiality or integrity impact, only availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious of untrusted MAVLink commands and restrict access to the drone's communication channels to trusted sources only.