CVSS 3.1
6.8 mediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2026-128910 DJI AeroScope Mobile: Hard-coded root password on the serial console
Medium (6.8) in dji.
On this page
Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an attacker with physical access to the board's serial console to log in as root. The same password hash is present on every unit and uses DES crypt, so the password can be recovered offline from the distributed firmware. No network login service accepts this password by default. Confirmed on a physical device.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.
Severity
- CWEs
- CWE-521 Weak Password Requirements
CWE-798 Use of Hard-coded Credentials
CWE-916 Use of Password Hash With Insufficient Computational Effort - Published
- Assigned by
- NCSC.ch (CNA)
- NVD analysis
- Awaiting analysis
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-128910 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-128910?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-128910?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-128910 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Badge for a README or a site
An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:
[](https://cve.bz/cve/CVE-2026-128910)
HTML:
<a href="https://cve.bz/cve/CVE-2026-128910"><img src="https://cve.bz/cve/badge/CVE-2026-128910.svg" alt="CVE-2026-128910"></a>
Affected
- dji:aeroscope mobile (tp703)
- dji:aeroscope mobile (tp703) 1300 communications board firmware
Versions
From the CNA's record in the CVE List.
| Product | Affected |
|---|---|
| DJI AeroScope Mobile (TP703) | 03.00.00.26 |
| DJI AeroScope Mobile (TP703) 1300 communications board firmware | from 02.00.07.12 through 02.00.08.40 |
Attack patterns (CAPEC)
- CAPEC-55 Rainbow Table Password Cracking Likelihood: Medium · Severity: Medium
- CAPEC-70 Try Common or Default Usernames and Passwords Likelihood: Medium · Severity: High
- CAPEC-191 Read Sensitive Constants Within an Executable Severity: Low
- CAPEC-16 Dictionary-based Password Attack Likelihood: Medium · Severity: High
- CAPEC-49 Password Brute Forcing Likelihood: Medium · Severity: High
- CAPEC-112 Brute Force Severity: High
- CAPEC-509 Kerberoasting Severity: High
- CAPEC-555 Remote Services with Stolen Credentials Severity: Very High
- CAPEC-561 Windows Admin Shares with Stolen Credentials
- CAPEC-565 Password Spraying Likelihood: High · Severity: High
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.