PT-2022-19927 · Dji · Dji Drone Devices

Kevin Finisterre · Published 2022-04-29 · Updated 2023-08-08 · CVE-2022-29945

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions DJI drone devices sold in 2017 through 2022

Description The issue concerns DJI drone devices broadcasting unencrypted information about the drone operator's physical location via the AeroScope protocol.

Recommendations For DJI drone devices sold in 2017 through 2022, consider disabling the AeroScope protocol until a patch or fix is available to prevent the broadcast of unencrypted location information.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2022-29945

Affected Products

Dji Drone Devices

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-29945 · Security Note
• https://t.me/cibsecurity/41687 · Telegram Post
• https://twitter.com/StarFire2258/status/1519767091829637120 · Note
• https://t.me/cvenotify/29491 · Telegram Post
• https://twitter.com/d0tslash/status/1519774807776284672 · Note
• https://theverge.com/2022/4/28/23046916/dji-aeroscope-signals-not-encrypted-drone-tracking · Note