---
id: "CVE-2026-128909"
page: "https://infrastack.ai/live/CVE-2026-128909"
kind: "vulnerability"
aliases: ["CVE-2026-128909"]
title: "DJI AeroScope Mobile: unsigned firmware accepted, giving root code execution on the board"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["dji-aeroscope", "drone-monitoring", "infrastructure", "iot"]
not_affected_if: ["not-on-shared-network", "other-firmware-version", "unit-retired"]
published_at: "2026-11-13T15:17:44+00:00"
first_seen_at: "2026-11-13T15:46:19+00:00"
updated_at: "2026-11-13T15:48:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128909", "first_seen_at": "2026-11-13T15:46:19+00:00"}]
exploit_sources: []
---

# DJI AeroScope Mobile: unsigned firmware accepted, giving root code execution on the board

Link for people: https://infrastack.ai/live/CVE-2026-128909 (this .md is for agents)

The firmware update handler on the 1300 communications board of DJI AeroScope Mobile checks only an MD5 checksum supplied in the same request, not a cryptographic signature. An unauthenticated attacker on the local network can install modified firmware and gain persistent code execution as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Identify any DJI AeroScope Mobile (TP703) units and their 1300 communications board firmware version, `02.00.07.12` through `02.00.08.40` is in the affected range
- Check whether the board accepts traffic on TCP port `16000` from the local network

## Fix

- DJI has discontinued AeroScope Mobile and no fixed firmware is available; isolate or retire the unit

## Timeline

- 2026-11-13T15:46:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128909

## From the sources

Improper verification of cryptographic signature (CWE-347) in the firmware update handler of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to install modified firmware, which gives persistent code execution as root. The device accepts any image that matches an MD5 checksum supplied in the same request and does not verify a signature. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. Reproduced by running the unmodified device binaries in emulation; not tested on a physical device.



NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_