medium4.0
CVE-2022-29945
DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol.
Impact
DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dji | Mavic 3 Firmware | All versions |
| Dji | Rc Pro Firmware | All versions |
| Dji | Air 2s Firmware | All versions |
| Dji | Air 2 Firmware | All versions |
| Dji | Mini 2 Firmware | All versions |
| Dji | Mini Se Firmware | All versions |
| Dji | Fpv Firmware | All versions |
| Dji | Fhantom 4 Pro Firmware | All versions |
| Dji | Inspire 2 Firmware | All versions |
| Dji | Zenmuse X7 Firmware | All versions |
| Dji | Zenmuse X5s Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- https://twitter.com/StarFire2258/status/1519767091829637120
- https://twitter.com/d0tslash/status/1519774807776284672
- https://www.theverge.com/2022/4/28/23046916/dji-aeroscope-signals-not-encrypted-drone-tracking
- https://twitter.com/StarFire2258/status/1519767091829637120
- https://twitter.com/d0tslash/status/1519774807776284672
- https://www.theverge.com/2022/4/28/23046916/dji-aeroscope-signals-not-encrypted-drone-tracking