PT-2024-2606 · Dji · Dji Mavic Mini 3 Pro

Diego Giubertoni · Published 2024-03-29 · Updated 2024-08-26 · CVE-2023-6949

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:A/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions DJI Mavic Mini 3 Pro (affected versions not specified)

Description A Missing Authentication for Critical Function issue affects the HTTP service running on the standard port 80, allowing an attacker to enumerate and download videos and pictures saved on the drone's internal or external memory without requiring authentication. This could enable a remote attacker to gain unauthorized access to protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2024-02673

CVE-2023-6949

Affected Products

Dji Mavic Mini 3 Pro

References · 14

• https://bdu.fstec.ru/vul/2024-02673 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-6949 · Security Note
• https://twitter.com/0xor0ne/status/1784875261554516206 · Twitter Post
• https://twitter.com/CVEnew/status/1775110291514179768 · Twitter Post
• https://twitter.com/0xor0ne/status/1776233514146419195 · Twitter Post
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2023-6949 · Note
• https://t.me/cvenotify/88497 · Telegram Post
• https://t.me/cvenotify/75459 · Telegram Post
• https://twitter.com/0xor0ne/status/1777698260452323389 · Twitter Post
• https://t.me/irozysk/13338 · Telegram Post
• https://t.me/cvenotify/75489 · Telegram Post
• https://twitter.com/0xor0ne/status/1827246987172835499 · Twitter Post
• https://vuldb.com/?id.259024 · Note
• https://twitter.com/Anastasis_King/status/1801328090775171446 · Twitter Post