---
id: "CVE-2026-128908"
page: "https://infrastack.ai/live/CVE-2026-128908"
kind: "vulnerability"
aliases: ["CVE-2026-128908"]
title: "DJI AeroScope Mobile: unauthenticated network command injection gives root access"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["aeroscope", "dji", "infrastructure", "iot", "uav-monitoring"]
not_affected_if: ["connected-to-controlling-host", "not-aeroscope-mobile", "port-16000-unreachable"]
published_at: "2026-11-13T15:17:44+00:00"
first_seen_at: "2026-11-13T15:46:19+00:00"
updated_at: "2026-11-13T15:48:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128908", "first_seen_at": "2026-11-13T15:46:19+00:00"}]
exploit_sources: []
---

# DJI AeroScope Mobile: unauthenticated network command injection gives root access

Link for people: https://infrastack.ai/live/CVE-2026-128908 (this .md is for agents)

The 1300 communications board in DJI AeroScope Mobile (TP703) accepts unauthenticated configuration writes on TCP port 16000 that are placed unquoted into shell commands. An attacker on the local network can run arbitrary commands as root, and the injected command persists across reboots.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the unit is a DJI AeroScope Mobile (TP703) and whether its 1300 communications board runs firmware `02.00.07.12` through `02.00.08.40`.
- Check whether TCP port 16000 on the board is reachable from the local network.

## Fix

- DJI has discontinued AeroScope Mobile and no fixed firmware is available.

## Timeline

- 2026-11-13T15:46:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128908

## From the sources

OS command injection (CWE-78) in the network-configuration handling of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to execute arbitrary commands as root. Configuration values that can be written without authentication over the management interface are inserted unquoted into shell commands. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. The injected command persists across reboots. Confirmed on a physical device.



NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_