{"api_version":"1","generated_at":"2026-11-13T16:51:17+00:00","cve":"CVE-2026-128910","urls":{"html":"https://cve.report/CVE-2026-128910","api":"https://cve.report/api/cve/CVE-2026-128910.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-128910","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-128910"},"summary":{"title":"DJI AeroScope Mobile: Hard-coded root password on the serial console","description":"Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an attacker with physical access to the board's serial console to log in as root. The same password hash is present on every unit and uses DES crypt, so the password can be recovered offline from the distributed firmware. No network login service accepts this password by default. Confirmed on a physical device.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.","state":"PUBLISHED","assigner":"NCSC.ch","published_at":"2026-11-13 15:17:44","updated_at":"2026-11-13 15:17:44"},"problem_types":["CWE-521","CWE-798","CWE-916","CWE-798 CWE-798 Use of Hard-coded Credentials","CWE-916 CWE-916 Use of Password Hash With Insufficient Computational Effort","CWE-521 CWE-521 Weak Password Requirements"],"metrics":[{"version":"3.1","source":"vulnerability@ncsc.ch","type":"Secondary","score":"6.8","severity":"MEDIUM","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.8","severity":"MEDIUM","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://www.dji.com/aeroscope","name":"https://www.dji.com/aeroscope","refsource":"vulnerability@ncsc.ch","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-128910/","name":"https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-128910/","refsource":"vulnerability@ncsc.ch","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/llorencroma/dji-aeroscope-root","name":"https://github.com/llorencroma/dji-aeroscope-root","refsource":"vulnerability@ncsc.ch","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-128910","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128910","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"DJI","product":"AeroScope Mobile (TP703)","version":"affected 03.00.00.26 custom","platforms":["ARM"]},{"source":"CNA","vendor":"DJI","product":"AeroScope Mobile (TP703) 1300 communications board firmware","version":"affected 02.00.07.12 02.00.08.40 custom","platforms":["ARM"]}],"timeline":[{"source":"CNA","time":"2026-09-25T00:00:00.000Z","lang":"en","value":"Confirmed on a physical device"},{"source":"CNA","time":"2026-09-25T00:00:00.000Z","lang":"en","value":"Reported to DJI"},{"source":"CNA","time":"2026-11-04T00:00:00.000Z","lang":"en","value":"DJI acknowledged the vulnerability and provided its assessment"}],"solutions":[{"source":"CNA","title":"","value":"DJI AeroScope Mobile has been discontinued and is no longer supported by DJI. No fixed firmware is available. Operators should plan to replace affected units with a supported product and, until then, apply the workarounds.","time":"","lang":"en"}],"workarounds":[{"source":"CNA","title":"","value":"Restrict physical access to deployed units and their serial console, and treat any unit that has left controlled custody as having a known root password. Network isolation does not mitigate this issue.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Llorenç Romá Alvarez, Security Researcher, Cyber Defence Campus, Switzerland","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://www.dji.com","defaultStatus":"unknown","modules":["1300 DM810X communications board (uavmonitor_usbv1; root console credential in /etc/shadow)"],"platforms":["ARM"],"product":"AeroScope Mobile (TP703)","programFiles":["etc/shadow","etc/passwd"],"vendor":"DJI","versions":[{"status":"affected","version":"03.00.00.26","versionType":"custom"}]},{"collectionURL":"https://www.dji.com","defaultStatus":"unknown","platforms":["ARM"],"product":"AeroScope Mobile (TP703) 1300 communications board firmware","vendor":"DJI","versions":[{"lessThanOrEqual":"02.00.08.40","status":"affected","version":"02.00.07.12","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","value":"Llorenç Romá Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an attacker with physical access to the board's serial console to log in as root. The same password hash is present on every unit and uses DES crypt, so the password can be recovered offline from the distributed firmware. No network login service accepts this password by default. Confirmed on a physical device.</p><p>NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.</p>"}],"value":"Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an attacker with physical access to the board's serial console to log in as root. The same password hash is present on every unit and uses DES crypt, so the password can be recovered offline from the distributed firmware. No network login service accepts this password by default. Confirmed on a physical device.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"Scored on the only login channel that accepts the credential: the board's serial console, which requires physical access, so AV:P. No network login service (SSH/telnet) runs on the board by default. The credential is not an escalation on a host where code execution has already been achieved. BLAST RADIUS: the credential is image-wide, not per-device, so a single recovery applies to every affected unit and an operator cannot contain a leak. The vendor should also determine whether the same credential is reused in other DJI product lines; reuse was not verified in this engagement."}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","description":"CWE-798 Use of Hard-coded Credentials","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-916","description":"CWE-916 Use of Password Hash With Insufficient Computational Effort","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-521","description":"CWE-521 Weak Password Requirements","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-13T14:31:31.193Z","orgId":"455daabc-a392-441d-aa46-37d35189897c","shortName":"NCSC.ch"},"references":[{"name":"Cyber Defence Campus vulnerability advisories","tags":["third-party-advisory"],"url":"https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-128910/"},{"name":"DJI AeroScope product page","tags":["product"],"url":"https://www.dji.com/aeroscope"},{"name":"DJI AeroScope Mobile research repository (technical details)","tags":["technical-description"],"url":"https://github.com/llorencroma/dji-aeroscope-root"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>DJI AeroScope Mobile has been discontinued and is no longer supported by DJI. No fixed firmware is available. Operators should plan to replace affected units with a supported product and, until then, apply the workarounds.</p>"}],"value":"DJI AeroScope Mobile has been discontinued and is no longer supported by DJI. No fixed firmware is available. Operators should plan to replace affected units with a supported product and, until then, apply the workarounds."}],"source":{"discovery":"EXTERNAL"},"tags":["unsupported-when-assigned"],"timeline":[{"lang":"en","time":"2026-09-25T00:00:00.000Z","value":"Confirmed on a physical device"},{"lang":"en","time":"2026-09-25T00:00:00.000Z","value":"Reported to DJI"},{"lang":"en","time":"2026-11-04T00:00:00.000Z","value":"DJI acknowledged the vulnerability and provided its assessment"}],"title":"DJI AeroScope Mobile: Hard-coded root password on the serial console","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Restrict physical access to deployed units and their serial console, and treat any unit that has left controlled custody as having a known root password. Network isolation does not mitigate this issue.</p>"}],"value":"Restrict physical access to deployed units and their serial console, and treat any unit that has left controlled custody as having a known root password. Network isolation does not mitigate this issue."}],"x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"455daabc-a392-441d-aa46-37d35189897c","assignerShortName":"NCSC.ch","cveId":"CVE-2026-128910","datePublished":"2026-11-13T14:31:31.193Z","dateReserved":"2026-11-13T12:42:56.446Z","dateUpdated":"2026-11-13T14:31:31.193Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-13 15:17:44","lastModifiedDate":"2026-11-13 15:17:44","problem_types":["CWE-521","CWE-798","CWE-916","CWE-798 CWE-798 Use of Hard-coded Credentials","CWE-916 CWE-916 Use of Password Hash With Insufficient Computational Effort","CWE-521 CWE-521 Weak Password Requirements"],"metrics":{"cvssMetricV31":[{"source":"vulnerability@ncsc.ch","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"128910","Ordinal":"1","Title":"DJI AeroScope Mobile: Hard-coded root password on the serial con","CVE":"CVE-2026-128910","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"128910","Ordinal":"1","NoteData":"Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an attacker with physical access to the board's serial console to log in as root. The same password hash is present on every unit and uses DES crypt, so the password can be recovered offline from the distributed firmware. No network login service accepts this password by default. Confirmed on a physical device.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.","Type":"Description","Title":"DJI AeroScope Mobile: Hard-coded root password on the serial con"}]}}}