PT-2022-6500 · Dji · Dji Spark

Jiin Jeong + 3 · Published 2022-04-12 · Updated 2025-02-19 · CVE-2022-46415

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AC:L/AV:N/A:H/C:L/I:L/PR:L/S:C/UI:N

Name of the Vulnerable Software and Affected Versions DJI Spark version 01.00.0900

Description The issue is related to a flaw in the implementation of the Dynamic Host Configuration Protocol (DHCP) in the DJI Spark drone's firmware, which can lead to the exhaustion of the IP address pool due to a security-critical code change. This can be exploited by a remote attacker to cause a denial of service by sending specially crafted packets. The exploitation involves connecting to the device's internal Wi-Fi network and then sending multiple DHCP request packets.

Recommendations For DJI Spark version 01.00.0900, to mitigate this issue, consider restricting access to the device's internal Wi-Fi network and limiting the number of DHCP requests that can be sent to the device. As a temporary workaround, avoid using the DHCP protocol until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-291

CWE-400

CWE-1037

Related Identifiers

BDU:2023-01783

CVE-2022-46415

GHSA-54Q2-3R2M-9PGM

Affected Products

Dji Spark

References · 8

• 🔥 https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-54q2-3r2m-9pgm · Exploit
• https://bdu.fstec.ru/vul/2023-01783 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-46415 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46415 · Vendor Advisory
• https://vuldb.com/ru/?id.224149 · Note
• https://smartstore.naver.com/chachablues/products/6617613337 · Note
• https://smartstore.naver.com/hancomawesome-tech/products/5367473135 · Note
• https://t.me/cvenotify/111820 · Telegram Post