PT-2024-14131 · Dji · Libv2 Sdk.So+9

Diego Giubertoni · Published 2024-04-02 · Updated 2024-09-30 · CVE-2023-51453

Positive Technologies (AI Summary)

CVSS v3.1

3.0

Low

Base vector

AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions DJI Mavic 3 Pro versions prior to v01.01.0300 DJI Mavic 3 versions prior to v01.00.1200 DJI Mavic 3 Classic versions prior to v01.00.0500 DJI Mavic 3 Enterprise versions prior to v07.01.10.03 DJI Matrice 300 versions prior to v57.00.01.00 DJI Matrice M30 versions prior to v07.01.0022 DJI Mini 3 Pro versions prior to v01.00.0620

Description An Improper Input Validation issue affects the v2 sdk service running on a set of DJI drone devices on the port 10000. This issue could allow an attacker to cause a crash of the service through a crafted payload, triggering a missing input size check in the process push file function implemented in the libv2 sdk.so library used by the dji vtwo sdk binary. This compromises the service in terms of availability and produces a denial-of-service attack.

Recommendations For DJI Mavic 3 Pro versions prior to v01.01.0300, update to version v01.01.0300 or later. For DJI Mavic 3 versions prior to v01.00.1200, update to version v01.00.1200 or later. For DJI Mavic 3 Classic versions prior to v01.00.0500, update to version v01.00.0500 or later. For DJI Mavic 3 Enterprise versions prior to v07.01.10.03, update to version v07.01.10.03 or later. For DJI Matrice 300 versions prior to v57.00.01.00, update to version v57.00.01.00 or later. For DJI Matrice M30 versions prior to v07.01.0022, update to version v07.01.0022 or later. For DJI Mini 3 Pro versions prior to v01.00.0620, update to version v01.00.0620 or later. As a temporary workaround, consider disabling the process push file function until a patch is available. Restrict access to the libv2 sdk.so library to minimize the risk of exploitation. Avoid using the vulnerable v2 sdk service on port 10000 until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2023-51453

Affected Products

Dji Matrice 300

Dji Matrice M30

Dji Mavic 3

Dji Mavic 3 Classic

Dji Mavic 3 Enterprise

Dji Mavic 3 Pro

Dji Mini 3 Pro

Dji Vtwo Sdk

Libv2 Sdk.So

V2 Sdk Service

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-51453 · Security Note
• https://twitter.com/RedPacketSec/status/1775449391777591657 · Twitter Post
• https://twitter.com/CVEnew/status/1775114061446885707 · Twitter Post
• https://t.me/cvenotify/75454 · Telegram Post
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2023-51453 · Note
• https://t.me/cvenotify/96534 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1775140225959821726 · Twitter Post