CVE-2026-128908: DJI AeroScope Mobile: OS command injection leads to root code execution
OS command injection (CWE-78) in the network-configuration handling of the management service (uavmonitorusbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to execute arbitrary commands as root. Configuration values that can be written without authentication over the management interface are inserted unquoted into shell commands. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. The injected command persists across reboots. Confirmed on a physical device.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Replace affected DJI AeroScope Mobile units with a supported product.
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
AeroScope Mobile TP703 units running firmware 03.00.00.26 with 1300 communications board firmware from 02.00.07.12 through 02.00.08.40 are affected when TCP port 16000 is reachable on the local network. Exploitation additionally requires that the unit is not connected to another controlling host.
Does exploitation require credentials or user interaction?
No. An unauthenticated attacker on the local network can write configuration values through the management interface, and no user interaction is required.
What level of access can an attacker obtain?
Successful exploitation allows arbitrary OS commands to be executed as root on the 1300 communications board. The injected command persists across reboots.
What can be done if patching is not possible?
No fixed firmware is available because AeroScope Mobile has been discontinued and is no longer supported. Restrict local-network access to TCP port 16000 and prevent untrusted systems from reaching the board's management interface; ensure the unit remains connected to its controlling host where operationally possible.
How can I identify potentially affected units?
Check whether the device is an AeroScope Mobile TP703 running firmware 03.00.00.26 and whether its 1300 communications board firmware is between 02.00.07.12 and 02.00.08.40. Also determine whether TCP port 16000 is exposed to the local network and whether the unit may operate without a controlling-host connection.