CVE-2026-128910: DJI AeroScope Mobile: Hard-coded root password on the serial console
Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an attacker with physical access to the board's serial console to log in as root. The same password hash is present on every unit and uses DES crypt, so the password can be recovered offline from the distributed firmware. No network login service accepts this password by default. Confirmed on a physical device.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Plan to replace affected DJI AeroScope Mobile units with a supported product.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Devices running DJI AeroScope Mobile (TP703) firmware 03.00.00.26 with 1300 communications board firmware from 02.00.07.12 through 02.00.08.40 are affected. Exploitation requires physical access to the 1300 communications board's serial console; the password is not accepted by a network login service by default.
What does an attacker need to exploit it?
An attacker needs physical access to the board and access to its serial console. The shared password hash can be recovered offline from distributed firmware because it uses DES crypt, then used to log in as root.
Is a firmware fix available?
No fixed firmware is available. DJI has discontinued AeroScope Mobile, and the affected products are no longer supported by the maintainer.
What can be done if the device cannot be replaced immediately?
Restrict physical access to the device and specifically prevent unauthorized access to the 1300 communications board and its serial console. Since the same credential hash is present on every unit, protecting console access is necessary across all affected devices.