CVE-2026-128909 is a high-severity vulnerability in DJI AeroScope Mobile (TP703) firmware 03.00.00.26 and 1300 communications board firmware versions 02.00.07.12 through 02.00.08.40. It involves improper verification of cryptographic signatures in the firmware update handler, allowing an unauthenticated local network attacker to install modified firmware. This leads to persistent root code execution. The device only checks an MD5 checksum supplied in the update request and does not verify a cryptographic signature. Exploitation requires network access to TCP port 16000 and that the device is not connected to another controlling host. No fix is available as the product is discontinued and unsupported by DJI.