CVE-2026-128909: DJI AeroScope Mobile: Firmware updates are not signature-verified
Improper verification of cryptographic signature (CWE-347) in the firmware update handler of the management service (uavmonitorusbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to install modified firmware, which gives persistent code execution as root. The device accepts any image that matches an MD5 checksum supplied in the same request and does not verify a signature. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. Reproduced by running the unmodified device binaries in emulation; not tested on a physical device.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Plan to replace affected DJI AeroScope Mobile units with a supported product.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments use DJI AeroScope Mobile (TP703) firmware 03.00.00.26 with 1300 communications board firmware from 02.00.07.12 through 02.00.08.40. The attacker must be able to reach TCP port 16000 on the communications board over the local network.
What conditions must be met for exploitation?
An unauthenticated attacker needs local-network access to the board's TCP port 16000. The unit must not be connected to another controlling host at the time of exploitation.
What access does successful exploitation provide?
An attacker can submit modified firmware because the update handler accepts an image based only on an MD5 checksum supplied in the same request and does not verify a signature. Installing that firmware provides persistent code execution as root.
Is a vendor fix available?
No fixed firmware is available. DJI has discontinued AeroScope Mobile, and the affected products are no longer supported by the maintainer.
What can be done if the device cannot be replaced immediately?
Limit local-network reachability to TCP port 16000 on the 1300 communications board, since access to that port is required for exploitation. Avoid leaving the device reachable by untrusted local-network users.