Command Injection Vulnerability in DJI Mavic 2 Remote Controller
CVE-2020-29664

7.8HIGH

Key Information:

Vendor

Dji

Status
Mavic 2 Firmware
Vendor
CVE Published:
18 February 2021

What is CVE-2020-29664?

The DJI Mavic 2 Remote Controller is susceptible to a command injection vulnerability that allows for arbitrary code execution. This vulnerability arises from inadequate validation of firmware upgrade packets. Attackers could exploit this flaw by sending a specially crafted firmware packet to the controller, potentially compromising its functionality. It is crucial for users to update to firmware version 01.00.0510 or later to mitigate this risk.

References

http://hacktheplanet.nu/djihax.pdf
x_refsource_MISC
http://kth.diva-portal.org/smash/get/diva2:1463784/FULLTE...
x_refsource_MISC
https://www.dji.com/mavic-2
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.