DJI AeroScope Mobile: Hard-coded root password on the serial console
Summary
| CVE | CVE-2026-128910 |
|---|---|
| State | PUBLISHED |
| Assigner | NCSC.ch |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-13 15:17:44 UTC |
| Updated | 2026-11-13 15:17:44 UTC |
| Description | Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an attacker with physical access to the board's serial console to log in as root. The same password hash is present on every unit and uses DES crypt, so the password can be recovered offline from the distributed firmware. No network login service accepts this password by default. Confirmed on a physical device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available. |
Risk And Classification
Primary CVSS: v3.1 6.8 MEDIUM from [email protected]
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-521 | CWE-798 | CWE-916 | CWE-798 CWE-798 Use of Hard-coded Credentials | CWE-916 CWE-916 Use of Password Hash With Insufficient Computational Effort | CWE-521 CWE-521 Weak Password Requirements
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 6.8 | MEDIUM | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 6.8 | MEDIUM | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | DJI | AeroScope Mobile TP703 | affected 03.00.00.26 custom | ARM |
| CNA | DJI | AeroScope Mobile TP703 1300 Communications Board Firmware | affected 02.00.07.12 02.00.08.40 custom | ARM |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.dji.com/aeroscope | [email protected] | www.dji.com | |
| cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-128910 | [email protected] | cyber-defence-campus.github.io | |
| github.com/llorencroma/dji-aeroscope-root | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Llorenç Romá Alvarez, Security Researcher, Cyber Defence Campus, Switzerland (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-09-25T00:00:00.000Z | Confirmed on a physical device |
| CNA | 2026-09-25T00:00:00.000Z | Reported to DJI |
| CNA | 2026-11-04T00:00:00.000Z | DJI acknowledged the vulnerability and provided its assessment |
Solutions
CNA: DJI AeroScope Mobile has been discontinued and is no longer supported by DJI. No fixed firmware is available. Operators should plan to replace affected units with a supported product and, until then, apply the workarounds.
Workarounds
CNA: Restrict physical access to deployed units and their serial console, and treat any unit that has left controlled custody as having a known root password. Network isolation does not mitigate this issue.