CVE-2026-128909 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The firmware update handler on the 1300 communications board of DJI AeroScope Mobile checks only an MD5 checksum supplied in the same request, not a cryptographic signature. An unauthenticated attacker on the local network can install modified firmware and gain persistent code execution as root.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that still run DJI AeroScope Mobile (TP703) units with 1300 communications board firmware 02.00.07.12 through 02.00.08.40 on a network segment reachable by untrusted hosts. The attack needs network access to TCP port 16000 on the board and a unit not connected to another controlling host. The product is no longer supported by the maintainer, so no patch will come.
Not affected if not-on-shared-network, other-firmware-version, unit-retired
Who cares dji-aeroscope, drone-monitoring, iot
02.00.07.12 through 02.00.08.40 is in the affected range16000 from the local networkImproper verification of cryptographic signature (CWE-347) in the firmware update handler of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to install modified firmware, which gives persistent code execution as root. The device accepts any image that matches an MD5 checksum supplied in the same request and does not verify a signature. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. Reproduced by running the unmodified device binaries in emulation; not tested on a physical device.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.
This page as .md · .json · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.