PT-2024-2641 · Dji · Dji Matrice M30+6

Diego Giubertoni · Published 2024-03-29 · Updated 2024-04-10 · CVE-2023-51454

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DJI Mavic 3 Pro versions prior to v01.01.0300 DJI Mavic 3 versions prior to v01.00.1200 DJI Mavic 3 Classic versions prior to v01.00.0500 DJI Mavic 3 Enterprise versions prior to v07.01.10.03 DJI Matrice 300 versions prior to v57.00.01.00 DJI Matrice M30 versions prior to v07.01.0022 DJI Mini 3 Pro versions prior to v01.00.0620

Description The issue is related to an Out-of-bounds Write problem affecting the v2 sdk service running on a set of DJI drone devices on port 10000. This could allow an attacker to overwrite a pointer in the process memory through a crafted payload, triggering an unsafe memory write operation in the my tcp receive function implemented in the libv2 sdk.so library. This potentially leads to a memory information leak or arbitrary code execution.

Recommendations For DJI Mavic 3 Pro versions prior to v01.01.0300, update the firmware to v01.01.0300 or later. For DJI Mavic 3 versions prior to v01.00.1200, update the firmware to v01.00.1200 or later. For DJI Mavic 3 Classic versions prior to v01.00.0500, update the firmware to v01.00.0500 or later. For DJI Mavic 3 Enterprise versions prior to v07.01.10.03, update the firmware to v07.01.10.03 or later. For DJI Matrice 300 versions prior to v57.00.01.00, update the firmware to v57.00.01.00 or later. For DJI Matrice M30 versions prior to v07.01.0022, update the firmware to v07.01.0022 or later. For DJI Mini 3 Pro versions prior to v01.00.0620, update the firmware to v01.00.0620 or later. As a temporary workaround, consider restricting access to the v2 sdk service on port 10000 until the firmware is updated.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2024-02708

CVE-2023-51454

Affected Products

Dji Matrice 300

Dji Matrice M30

Dji Mavic 3

Dji Mavic 3 Classic

Dji Mavic 3 Enterprise

Dji Mavic 3 Pro

Dji Mini 3 Pro

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-51454 · Security Note
• https://bdu.fstec.ru/vul/2024-02708 · Security Note
• https://twitter.com/RedPacketSec/status/1775449386803175653 · Twitter Post
• https://twitter.com/CVEnew/status/1775114060230455658 · Twitter Post
• https://t.me/cvenotify/75455 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1775139719522709837 · Twitter Post
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2023-51454 · Note
• https://twitter.com/oktsec/status/1778151423928091032 · Twitter Post
• https://vuldb.com/fr/?id.259017 · Note