Security readout for executives and security teams
Plain-English summary
CVE-2024-33844 is an availability issue affecting the drone-control path described for Parrot ANAFI USA firmware 1.10.4. A malformed MAVLink mission message can disconnect the controller from the drone. The business concern is mission disruption, not data theft. The public record does not show confirmed exploitation or a named patch.
Executive priority
Treat this as high priority for teams using affected drones in operational, emergency, inspection, or security missions. The main risk is loss of control connectivity during use. Prioritize inventory, vendor confirmation, and operational restrictions before relying on affected firmware for critical work.
Technical view
The reported flaw is missing validation of MAV_MISSION_TYPE values in the firmware control component when processing MAVLink MISSION_COUNT messages. CVSS 3.1 is 7.5: network-reachable, low complexity, no privileges, no user interaction, with high availability impact only. Structured affected-product metadata is incomplete in the provided CVE data.
Likely exposure
Organizations operating Parrot ANAFI USA firmware 1.10.4 are the clearest exposed group. The forum title also references ANAFI Thermal/USA firmware, but the supplied structured affected fields are n/a, so fleet owners should validate exact models and firmware against Parrot guidance.
Exploitation context
The CVE is not listed as KEV in the provided bundle, and no cited source confirms active exploitation. The described impact requires the ability to send MAVLink traffic that reaches the drone-control component, making operational network and radio exposure important.
Researcher notes
Evidence is limited to the CVE description and Parrot forum references. The affected-product metadata is not normalized, and no patch details are included in the supplied sources. Further analysis should focus on vendor-confirmed model scope, firmware lineage, and whether control-channel exposure is realistic in deployed environments.
Mitigation direction
- Check Parrot guidance and the forum thread for an official fixed firmware or workaround.
- Inventory ANAFI USA and related Parrot drone firmware versions in operational fleets.
- Restrict untrusted access to drone-control networks and MAVLink paths where operationally possible.
- Avoid affected firmware for safety-critical missions until vendor guidance is confirmed.
- Apply only vendor-approved firmware updates when Parrot publishes a fix.
Validation and detection
- Confirm whether any Parrot ANAFI USA devices run firmware 1.10.4.
- Review mission-control architecture for paths that can send MAVLink to drones.
- Check asset records for ANAFI Thermal/USA variants requiring vendor clarification.
- Monitor the CVE record and Parrot forum for scope or remediation updates.
- Validate resilience only in an authorized lab using approved vendor procedures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-404: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-33844 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://forum.developer.parrot.com/t/cve-2024-33844-bugs-in-anafi-thermal-usa-firmware/22501CVE reference, mitre
- https://forum.developer.parrot.com/t/cve-2024-33844-bugs-in-anafi-thermal-usa-firmware/22501/1CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Resource Shutdown or Release
Improper Resource Shutdown or Release represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.