PT-2024-14130 · Dji · Dji Matrice M30+6

Diego Giubertoni · Published 2024-04-02 · Updated 2024-09-30 · CVE-2023-51452

Positive Technologies (AI Summary)

CVSS v3.1

3.0

Low

Base vector

AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions DJI Mavic 3 Pro versions prior to v01.01.0300 DJI Mavic 3 versions prior to v01.00.1200 DJI Mavic 3 Classic versions prior to v01.00.0500 DJI Mavic 3 Enterprise versions prior to v07.01.10.03 DJI Matrice 300 versions prior to v57.00.01.00 DJI Matrice M30 versions prior to v07.01.0022 DJI Mini 3 Pro versions prior to v01.00.0620

Description An Improper Input Validation issue affects the v2 sdk service running on a set of DJI drone devices on the port 10000. This issue could allow an attacker to cause a crash of the service through a crafted payload, triggering a missing input size check in the pull file v2 proc function implemented in the libv2 sdk.so library used by the dji vtwo sdk binary. This compromises the service in terms of availability and produces a denial-of-service attack.

Recommendations For DJI Mavic 3 Pro versions prior to v01.01.0300, update to version v01.01.0300 or later. For DJI Mavic 3 versions prior to v01.00.1200, update to version v01.00.1200 or later. For DJI Mavic 3 Classic versions prior to v01.00.0500, update to version v01.00.0500 or later. For DJI Mavic 3 Enterprise versions prior to v07.01.10.03, update to version v07.01.10.03 or later. For DJI Matrice 300 versions prior to v57.00.01.00, update to version v57.00.01.00 or later. For DJI Matrice M30 versions prior to v07.01.0022, update to version v07.01.0022 or later. For DJI Mini 3 Pro versions prior to v01.00.0620, update to version v01.00.0620 or later. As a temporary workaround, consider restricting access to the v2 sdk service on port 10000 to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2023-51452

Affected Products

Dji Matrice 300

Dji Matrice M30

Dji Mavic 3

Dji Mavic 3 Classic

Dji Mavic 3 Enterprise

Dji Mavic 3 Pro

Dji Mini 3 Pro

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-51452 · Security Note
• https://t.me/cvenotify/75453 · Telegram Post
• https://twitter.com/RedPacketSec/status/1775449388011114789 · Twitter Post
• https://twitter.com/CVEnew/status/1775110288393515275 · Twitter Post
• https://t.me/cvenotify/96533 · Telegram Post
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2023-51452 · Note
• https://twitter.com/VulmonFeeds/status/1775140985191674339 · Twitter Post