Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an attacker with physical access to the board's serial console to log in as root. The same password hash is present on every unit and uses DES crypt, so the password can be recovered offline from the distributed firmware. No network login service accepts this password by default. Confirmed on a physical device.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.
"}]}],"tags":["unsupported-when-assigned"],"references":[{"url":"https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-128910/","name":"Cyber Defence Campus vulnerability advisories","tags":["third-party-advisory"]},{"url":"https://www.dji.com/aeroscope","name":"DJI AeroScope product page","tags":["product"]},{"url":"https://github.com/llorencroma/dji-aeroscope-root","name":"DJI AeroScope Mobile research repository (technical details)","tags":["technical-description"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"Scored on the only login channel that accepts the credential: the board's serial console, which requires physical access, so AV:P. No network login service (SSH/telnet) runs on the board by default. The credential is not an escalation on a host where code execution has already been achieved. BLAST RADIUS: the credential is image-wide, not per-device, so a single recovery applies to every affected unit and an operator cannot contain a leak. The vendor should also determine whether the same credential is reused in other DJI product lines; reuse was not verified in this engagement."}],"cvssV3_1":{"version":"3.1","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"MEDIUM","baseScore":6.8,"vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"workarounds":[{"lang":"en","value":"Restrict physical access to deployed units and their serial console, and treat any unit that has left controlled custody as having a known root password. Network isolation does not mitigate this issue.","supportingMedia":[{"type":"text/html","base64":false,"value":"Restrict physical access to deployed units and their serial console, and treat any unit that has left controlled custody as having a known root password. Network isolation does not mitigate this issue.
"}]}],"solutions":[{"lang":"en","value":"DJI AeroScope Mobile has been discontinued and is no longer supported by DJI. No fixed firmware is available. Operators should plan to replace affected units with a supported product and, until then, apply the workarounds.","supportingMedia":[{"type":"text/html","base64":false,"value":"DJI AeroScope Mobile has been discontinued and is no longer supported by DJI. No fixed firmware is available. Operators should plan to replace affected units with a supported product and, until then, apply the workarounds.
"}]}],"timeline":[{"time":"2026-09-25T00:00:00.000Z","lang":"en","value":"Confirmed on a physical device"},{"time":"2026-09-25T00:00:00.000Z","lang":"en","value":"Reported to DJI"},{"time":"2026-11-04T00:00:00.000Z","lang":"en","value":"DJI acknowledged the vulnerability and provided its assessment"}],"credits":[{"lang":"en","value":"Llorenç Romá Alvarez, Security Researcher, Cyber Defence Campus, Switzerland","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}}}}