PT-2024-2607 · Dji · Dji Matrice M30+6

Niccolo Facchi

+1

·

Published

2024-03-29

·

Updated

2024-09-30

·

CVE-2023-6951

CVSS v3.1

6.6

Medium

VectorAV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions DJI Mavic 3 Pro versions prior to v01.01.0300 DJI Mavic 3 versions prior to v01.00.1200 DJI Mavic 3 Classic versions prior to v01.00.0500 DJI Mavic 3 Enterprise versions prior to v07.01.10.03 DJI Matrice 300 versions prior to v57.00.01.00 DJI Matrice M30 versions prior to v07.01.0022 DJI Mini 3 Pro versions prior to v01.00.0620
Description A Use of Weak Credentials issue affects the Wi-Fi network generated by a set of DJI drones, allowing a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone's Wi-Fi network. This enables the attacker to perform unauthorized interaction with the network services exposed by the drone and potentially decrypt the Wi-Fi traffic exchanged between the drone and the Android/IOS device of the legitimate user during QuickTransfer mode.
Recommendations For DJI Mavic 3 Pro versions prior to v01.01.0300, update to v01.01.0300 or later to resolve the issue. For DJI Mavic 3 versions prior to v01.00.1200, update to v01.00.1200 or later to resolve the issue. For DJI Mavic 3 Classic versions prior to v01.00.0500, update to v01.00.0500 or later to resolve the issue. For DJI Mavic 3 Enterprise versions prior to v07.01.10.03, update to v07.01.10.03 or later to resolve the issue. For DJI Matrice 300 versions prior to v57.00.01.00, update to v57.00.01.00 or later to resolve the issue. For DJI Matrice M30 versions prior to v07.01.0022, update to v07.01.0022 or later to resolve the issue. For DJI Mini 3 Pro versions prior to v01.00.0620, update to v01.00.0620 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-334CWE-1392

Related Identifiers

BDU:2024-02674
CVE-2023-6951

Affected Products

Dji Matrice 300
Dji Matrice M30
Dji Mavic 3
Dji Mavic 3 Classic
Dji Mavic 3 Enterprise
Dji Mavic 3 Pro
Dji Mini 3 Pro