CVSS 3.1
4.3 mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVE-2026-128907 DJI AeroScope Mobile: Missing authentication on the management interface
Medium (4.3) in dji.
On this page
Missing authentication for a critical function (CWE-306) in the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to read device information, such as the serial number, MAC address, IP address and radio configuration, and to change configuration settings. The service accepts commands in DJI's proprietary DUML protocol without any authentication. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. The same commands are also accepted over the USB operator port. Confirmed on a physical device.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.
Severity
- CWE
- CWE-306 Missing Authentication for Critical Functionality
- OWASP Top 10
- A07:2025 Authentication Failures
- Published
- Assigned by
- NCSC.ch (CNA)
- NVD analysis
- Awaiting analysis
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-128907 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-128907?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-128907?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-128907 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Badge for a README or a site
An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:
[](https://cve.bz/cve/CVE-2026-128907)
HTML:
<a href="https://cve.bz/cve/CVE-2026-128907"><img src="https://cve.bz/cve/badge/CVE-2026-128907.svg" alt="CVE-2026-128907"></a>
Affected
- dji:aeroscope mobile (tp703)
- dji:aeroscope mobile (tp703) 1300 communications board firmware
Versions
From the CNA's record in the CVE List.
| Product | Affected |
|---|---|
| DJI AeroScope Mobile (TP703) | 03.00.00.26 |
| DJI AeroScope Mobile (TP703) 1300 communications board firmware | from 02.00.07.12 through 02.00.08.40 |
Attack patterns (CAPEC)
- CAPEC-12 Choosing Message Identifier Likelihood: High · Severity: High
- CAPEC-36 Using Unpublished Interfaces or Functionality Likelihood: Medium · Severity: High
- CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
- CAPEC-166 Force the System to Reset Values Severity: Medium
- CAPEC-216 Communication Channel Manipulation
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.