{"id":"CVE-2026-128909","kind":"vulnerability","aliases":["CVE-2026-128909"],"related":[],"title":"DJI AeroScope Mobile: unsigned firmware accepted, giving root code execution on the board","description":"Improper verification of cryptographic signature (CWE-347) in the firmware update handler of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to install modified firmware, which gives persistent code execution as root. The device accepts any image that matches an MD5 checksum supplied in the same request and does not verify a signature. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. Reproduced by running the unmodified device binaries in emulation; not tested on a physical device.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.","summary":"The firmware update handler on the 1300 communications board of DJI AeroScope Mobile checks only an MD5 checksum supplied in the same request, not a cryptographic signature. An unauthenticated attacker on the local network can install modified firmware and gain persistent code execution as root.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dji-aeroscope","drone-monitoring","infrastructure","iot"],"not_affected_if":["not-on-shared-network","other-firmware-version","unit-retired"],"how_to_check":"- Identify any DJI AeroScope Mobile (TP703) units and their 1300 communications board firmware version, `02.00.07.12` through `02.00.08.40` is in the affected range\n- Check whether the board accepts traffic on TCP port `16000` from the local network","fix":"- DJI has discontinued AeroScope Mobile and no fixed firmware is available; isolate or retire the unit","status":"open","published_at":"2026-11-13T15:17:44+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","triaged_at":"2026-11-13T15:48:10+00:00","updated_at":"2026-11-13T15:48:10+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T15:48:10Z","model":"claude-haiku-5-5","output":{"fix":"- DJI has discontinued AeroScope Mobile and no fixed firmware is available; isolate or retire the unit","reach":"network","title":"DJI AeroScope Mobile: unsigned firmware accepted, giving root code execution on the board","impact":"high","summary":"The firmware update handler on the 1300 communications board of DJI AeroScope Mobile checks only an MD5 checksum supplied in the same request, not a cryptographic signature. An unauthenticated attacker on the local network can install modified firmware and gain persistent code execution as root.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["dji-aeroscope","iot","drone-monitoring"],"confidence":0.8,"fix_status":"none","needs_auth":"no","worst_case":"Attacker runs persistent root code on the monitoring board","analyst_note":"","how_to_check":"- Identify any DJI AeroScope Mobile (TP703) units and their 1300 communications board firmware version, `02.00.07.12` through `02.00.08.40` is in the affected range\n- Check whether the board accepts traffic on TCP port `16000` from the local network\n- unknown for anything beyond this","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["unit-retired","not-on-shared-network","other-firmware-version"],"who_is_affected":"Teams that still run DJI AeroScope Mobile (TP703) units with 1300 communications board firmware 02.00.07.12 through 02.00.08.40 on a network segment reachable by untrusted hosts. The attack needs network access to TCP port 16000 on the board and a unit not connected to another controlling host. The product is no longer supported by the maintainer, so no patch will come.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000793,"input_tokens":4757,"output_tokens":634,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-128909':16A,19A '-2026':15A,18A '-347':79C '02.00.07.12':108C '02.00.08.40':110C '03.00.00.26':102C '1300':34B,93C,104C '16000':158C 'accept':6A,132C 'access':154C 'aeroscop':2A,22B,39B,98C,205C 'affect':192C 'allow':111C 'anoth':170C 'attack':57B,114C 'avail':212C 'binari':179C 'board':13A,36B,95C,106C,161C 'check':41B 'checksum':45B,139C 'code':9A,69B,126C 'communic':35B,94C,105C 'connect':168C 'control':171C 'cryptograph':53B,76C 'cve':14A,17A 'cwe':78C 'devic':131C,178C,187C 'discontinu':204C 'dji':1A,21B,38B,97C,202C 'dji-aeroscop':20B 'drone':24B 'drone-monitor':23B 'emul':181C 'execut':10A,70B,127C 'exploit':151C 'firmwar':5A,29B,65B,82C,101C,107C,122C,210C 'fix':209C 'gain':67B 'give':7A,124C 'handler':31B,84C 'host':172C 'imag':134C 'improp':73C 'infrastructur':26B 'instal':63B,120C 'iot':27B 'local':60B,117C 'longer':197C 'maintain':201C 'manag':87C 'match':136C 'md5':44B,138C 'mobil':3A,40B,99C,206C 'modifi':64B,121C 'monitor':25B 'network':61B,118C,153C 'note':188C 'persist':68B,125C 'physic':186C 'port':157C 'product':193C 'reproduc':173C 'request':50B,144C 'requir':152C 'root':8A,72B,129C 'run':175C 'servic':88C 'signatur':54B,77C,150C 'suppli':46B,140C 'support':198C 'tcp':156C 'test':183C 'tp703':100C 'uavmonitor':89C 'unauthent':56B,113C 'unit':165C 'unmodifi':177C 'unsign':4A 'updat':30B,83C 'usbv1':90C 'verif':74C 'verifi':148C 'vulner':190C","nicknames":[],"mitigations":[],"who_affected":"Teams that still run DJI AeroScope Mobile (TP703) units with 1300 communications board firmware 02.00.07.12 through 02.00.08.40 on a network segment reachable by untrusted hosts. The attack needs network access to TCP port 16000 on the board and a unit not connected to another controlling host. The product is no longer supported by the maintainer, so no patch will come.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["djiaeroscope","dronemonitoring","high","infrastructure","iot"],"campaign_type":null,"search_a":"'-128909':16A,19A '-2026':15A,18A 'accept':6A 'aeroscop':2A 'board':13A 'code':9A 'cve':14A,17A 'dji':1A 'execut':10A 'firmwar':5A 'give':7A 'mobil':3A 'root':8A 'unsign':4A","search_b":"'1300':34B 'aeroscop':22B,39B 'attack':57B 'board':36B 'check':41B 'checksum':45B 'code':69B 'communic':35B 'cryptograph':53B 'dji':21B,38B 'dji-aeroscop':20B 'drone':24B 'drone-monitor':23B 'execut':70B 'firmwar':29B,65B 'gain':67B 'handler':31B 'infrastructur':26B 'instal':63B 'iot':27B 'local':60B 'md5':44B 'mobil':40B 'modifi':64B 'monitor':25B 'network':61B 'persist':68B 'request':50B 'root':72B 'signatur':54B 'suppli':46B 'unauthent':56B 'updat':30B","search_c":"'-347':79C '02.00.07.12':108C '02.00.08.40':110C '03.00.00.26':102C '1300':93C,104C '16000':158C 'accept':132C 'access':154C 'aeroscop':98C,205C 'affect':192C 'allow':111C 'anoth':170C 'attack':114C 'avail':212C 'binari':179C 'board':95C,106C,161C 'checksum':139C 'code':126C 'communic':94C,105C 'connect':168C 'control':171C 'cryptograph':76C 'cwe':78C 'devic':131C,178C,187C 'discontinu':204C 'dji':97C,202C 'emul':181C 'execut':127C 'exploit':151C 'firmwar':82C,101C,107C,122C,210C 'fix':209C 'give':124C 'handler':84C 'host':172C 'imag':134C 'improp':73C 'instal':120C 'local':117C 'longer':197C 'maintain':201C 'manag':87C 'match':136C 'md5':138C 'mobil':99C,206C 'modifi':121C 'network':118C,153C 'note':188C 'persist':125C 'physic':186C 'port':157C 'product':193C 'reproduc':173C 'request':144C 'requir':152C 'root':129C 'run':175C 'servic':88C 'signatur':77C,150C 'suppli':140C 'support':198C 'tcp':156C 'test':183C 'tp703':100C 'uavmonitor':89C 'unauthent':113C 'unit':165C 'unmodifi':177C 'updat':83C 'usbv1':90C 'verif':74C 'verifi':148C 'vulner':190C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"vulnerability@ncsc.ch","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128909","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128909","severity":null,"published_at":"2026-11-13T15:17:44+00:00","modified_at":"2026-11-13T15:17:44+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","fetched_at":"2026-11-13T15:46:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}