{"id":"CVE-2026-128908","kind":"vulnerability","aliases":["CVE-2026-128908"],"related":[],"title":"DJI AeroScope Mobile: unauthenticated network command injection gives root access","description":"OS command injection (CWE-78) in the network-configuration handling of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to execute arbitrary commands as root. Configuration values that can be written without authentication over the management interface are inserted unquoted into shell commands. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. The injected command persists across reboots. Confirmed on a physical device.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.","summary":"The 1300 communications board in DJI AeroScope Mobile (TP703) accepts unauthenticated configuration writes on TCP port 16000 that are placed unquoted into shell commands. An attacker on the local network can run arbitrary commands as root, and the injected command persists across reboots.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aeroscope","dji","infrastructure","iot","uav-monitoring"],"not_affected_if":["connected-to-controlling-host","not-aeroscope-mobile","port-16000-unreachable"],"how_to_check":"- Check whether the unit is a DJI AeroScope Mobile (TP703) and whether its 1300 communications board runs firmware `02.00.07.12` through `02.00.08.40`.\n- Check whether TCP port 16000 on the board is reachable from the local network.","fix":"- DJI has discontinued AeroScope Mobile and no fixed firmware is available.","status":"open","published_at":"2026-11-13T15:17:44+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","triaged_at":"2026-11-13T15:48:08+00:00","updated_at":"2026-11-13T15:48:08+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T15:48:08Z","model":"claude-haiku-5-5","output":{"fix":"- DJI has discontinued AeroScope Mobile and no fixed firmware is available.","reach":"network","title":"DJI AeroScope Mobile: unauthenticated network command injection gives root access","impact":"high","summary":"The 1300 communications board in DJI AeroScope Mobile (TP703) accepts unauthenticated configuration writes on TCP port 16000 that are placed unquoted into shell commands. An attacker on the local network can run arbitrary commands as root, and the injected command persists across reboots.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["dji","aeroscope","uav-monitoring","iot"],"confidence":0.8,"fix_status":"none","needs_auth":"no","worst_case":"Attacker runs arbitrary commands as root on the board, persistently","analyst_note":"Confirm the 1300 board firmware range and whether isolation or retirement is the only available mitigation via the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-128908.","how_to_check":"- Check whether the unit is a DJI AeroScope Mobile (TP703) and whether its 1300 communications board runs firmware `02.00.07.12` through `02.00.08.40`.\n- Check whether TCP port 16000 on the board is reachable from the local network.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-aeroscope-mobile","port-16000-unreachable","connected-to-controlling-host"],"who_is_affected":"Only units of the DJI AeroScope Mobile (TP703) with the affected 1300 communications board firmware are exposed, and only when TCP port 16000 on the board can be reached from the network and the unit is not connected to another controlling host. The product is discontinued and no fixed firmware exists, so the practical step is to isolate the board from untrusted network segments or retire the unit.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000819,"input_tokens":4740,"output_tokens":689,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-128908':13A,16A '-2026':12A,15A '-78':71C '02.00.07.12':101C '02.00.08.40':103C '03.00.00.26':95C '1300':25B,86C,97C '16000':40B,143C 'accept':33B 'access':10A,139C 'across':65B,162C 'aeroscop':2A,17B,30B,91C,186C 'affect':173C 'allow':104C 'anoth':155C 'arbitrari':56B,114C 'attack':49B,107C 'authent':125C 'avail':193C 'board':27B,88C,99C,146C 'command':6A,47B,57B,63B,68C,115C,135C,160C 'communic':26B,87C,98C 'configur':35B,76C,118C 'confirm':164C 'connect':153C 'control':156C 'cve':11A,14A 'cwe':70C 'devic':168C 'discontinu':185C 'dji':1A,18B,29B,90C,183C 'execut':113C 'exploit':136C 'firmwar':94C,100C,191C 'fix':190C 'give':8A 'handl':77C 'host':157C 'infrastructur':19B 'inject':7A,62B,69C,159C 'insert':131C 'interfac':129C 'iot':20B 'local':52B,110C 'longer':178C 'maintain':182C 'manag':80C,128C 'mobil':3A,31B,92C,187C 'monitor':23B 'network':5A,53B,75C,111C,138C 'network-configur':74C 'note':169C 'os':67C 'persist':64B,161C 'physic':167C 'place':43B 'port':39B,142C 'product':174C 'reboot':66B,163C 'requir':137C 'root':9A,59B,117C 'run':55B 'servic':81C 'shell':46B,134C 'support':179C 'tcp':38B,141C 'tp703':32B,93C 'uav':22B 'uav-monitor':21B 'uavmonitor':82C 'unauthent':4A,34B,106C 'unit':150C 'unquot':44B,132C 'usbv1':83C 'valu':119C 'vulner':171C 'without':124C 'write':36B 'written':123C","nicknames":[],"mitigations":[],"who_affected":"Only units of the DJI AeroScope Mobile (TP703) with the affected 1300 communications board firmware are exposed, and only when TCP port 16000 on the board can be reached from the network and the unit is not connected to another controlling host. The product is discontinued and no fixed firmware exists, so the practical step is to isolate the board from untrusted network segments or retire the unit.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aeroscope","dji","high","infrastructure","iot","uavmonitoring"],"campaign_type":null,"search_a":"'-128908':13A,16A '-2026':12A,15A 'access':10A 'aeroscop':2A 'command':6A 'cve':11A,14A 'dji':1A 'give':8A 'inject':7A 'mobil':3A 'network':5A 'root':9A 'unauthent':4A","search_b":"'1300':25B '16000':40B 'accept':33B 'across':65B 'aeroscop':17B,30B 'arbitrari':56B 'attack':49B 'board':27B 'command':47B,57B,63B 'communic':26B 'configur':35B 'dji':18B,29B 'infrastructur':19B 'inject':62B 'iot':20B 'local':52B 'mobil':31B 'monitor':23B 'network':53B 'persist':64B 'place':43B 'port':39B 'reboot':66B 'root':59B 'run':55B 'shell':46B 'tcp':38B 'tp703':32B 'uav':22B 'uav-monitor':21B 'unauthent':34B 'unquot':44B 'write':36B","search_c":"'-78':71C '02.00.07.12':101C '02.00.08.40':103C '03.00.00.26':95C '1300':86C,97C '16000':143C 'access':139C 'across':162C 'aeroscop':91C,186C 'affect':173C 'allow':104C 'anoth':155C 'arbitrari':114C 'attack':107C 'authent':125C 'avail':193C 'board':88C,99C,146C 'command':68C,115C,135C,160C 'communic':87C,98C 'configur':76C,118C 'confirm':164C 'connect':153C 'control':156C 'cwe':70C 'devic':168C 'discontinu':185C 'dji':90C,183C 'execut':113C 'exploit':136C 'firmwar':94C,100C,191C 'fix':190C 'handl':77C 'host':157C 'inject':69C,159C 'insert':131C 'interfac':129C 'local':110C 'longer':178C 'maintain':182C 'manag':80C,128C 'mobil':92C,187C 'network':75C,111C,138C 'network-configur':74C 'note':169C 'os':67C 'persist':161C 'physic':167C 'port':142C 'product':174C 'reboot':163C 'requir':137C 'root':117C 'servic':81C 'shell':134C 'support':179C 'tcp':141C 'tp703':93C 'uavmonitor':82C 'unauthent':106C 'unit':150C 'unquot':132C 'usbv1':83C 'valu':119C 'vulner':171C 'without':124C 'written':123C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"vulnerability@ncsc.ch","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128908","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128908","severity":null,"published_at":"2026-11-13T15:17:44+00:00","modified_at":"2026-11-13T15:17:44+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","fetched_at":"2026-11-13T15:46:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}