CVE-2023-6951 | Nozomi Networks Labs

Summary

A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone’s Wi-Fi network.

Impact

A remote unathenticated attacker may connect to the DJI drone exposed access point.

Issue Date

March 29, 2024

Affects

This issue affects: Mavic 3 Pro below version 01.01.0300, Mavic 3 below version 01.00.1200, Mavic 3 Classic below version 01.00.0500, Mavic 3 Enterprise below version 7.01.10.03, Matrice 300 below version 57.00.01.00, Matrice M30 below version 07.01.0022, Mini 3 Pro below version 01.00.0620

CVE Name

CVE-2023-6951

CVSS Details

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

CVSS Score

6.6

Solution

Upgrade the firmware of impacted models to the latest available version

Mitigations

Acknowledgements

Niccolo' Facchi of Nozomi Networks

Nozomi Threat Intelligence

Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.

Learn more