CVE-2026-128908 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The 1300 communications board in DJI AeroScope Mobile (TP703) accepts unauthenticated configuration writes on TCP port 16000 that are placed unquoted into shell commands. An attacker on the local network can run arbitrary commands as root, and the injected command persists across reboots.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only units of the DJI AeroScope Mobile (TP703) with the affected 1300 communications board firmware are exposed, and only when TCP port 16000 on the board can be reached from the network and the unit is not connected to another controlling host. The product is discontinued and no fixed firmware exists, so the practical step is to isolate the board from untrusted network segments or retire the unit.
Not affected if connected-to-controlling-host, not-aeroscope-mobile, port-16000-unreachable
Who cares aeroscope, dji, iot, uav-monitoring
02.00.07.12 through 02.00.08.40.OS command injection (CWE-78) in the network-configuration handling of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to execute arbitrary commands as root. Configuration values that can be written without authentication over the management interface are inserted unquoted into shell commands. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. The injected command persists across reboots. Confirmed on a physical device.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.
This page as .md · .json · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.