DHCP Exhaustion Vulnerability in DJI Spark Drone

CVE-2022-46415

What is CVE-2022-46415?

The DJI Spark drone, with firmware version 01.00.0900, is susceptible to a vulnerability that enables remote attackers to disrupt legitimate connections by exhausting the DHCP IP address pool. To exploit this weakness, an attacker must first connect to the drone's internal Wi-Fi network, potentially through password guessing. Once connected, the attacker can flood the network with unnecessary DHCP request packets, leading to denial of service for legitimate users attempting to connect.

References