CVE-2026-128907: DJI AeroScope Mobile: Missing authentication on the management interface
Missing authentication for a critical function (CWE-306) in the management service (uavmonitorusbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to read device information, such as the serial number, MAC address, IP address and radio configuration, and to change configuration settings. The service accepts commands in DJI's proprietary DUML protocol without any authentication. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. The same commands are also accepted over the USB operator port. Confirmed on a physical device.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Plan to replace affected DJI AeroScope Mobile units with a supported product.
Event History
Frequently Asked Questions
Which deployments are exposed to network-based exploitation?
An affected unit is exposed when an attacker can reach TCP port 16000 on its 1300 communications board over the local network. Exploitation also requires that the unit is not connected to another controlling host.
What can an unauthenticated attacker do?
An attacker can use DJI's proprietary DUML commands without authentication to read device information, including the serial number, MAC address, IP address, and radio configuration. They can also change configuration settings.
Are the affected firmware versions patched?
No fixed firmware is available. DJI has discontinued AeroScope Mobile, and the vulnerability affects products that are no longer supported by the maintainer.
What mitigation is available if firmware cannot be patched?
Restrict access to TCP port 16000 on the 1300 communications board so untrusted local-network users cannot reach it. Control physical access to the USB operator port as well, because the same commands are accepted there.