Threats Tagged 'cwe-311'

DJI drones using the DUML protocol over Bluetooth Low Energy (BLE) transmit Wi-Fi credentials unencrypted. An attacker within BLE range can passively capture these credentials, including Wi-Fi SSID, PSK, and a trusted session UUID, allowing unauthorized access to the drone's Wi-Fi network and services. The vulnerability affects multiple DJI drone models with firmware versions prior to specified updates. Remediation requires a vendor firmware update; no user-side mitigation fully addresses the issue.

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchange_mode causes missing encryption of sensitive data. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The vendor was contacted early about this disclosure.

CVE-2026-21079 is a vulnerability in Samsung Mobile Smart Switch where sensitive data transmitted by the application prior to version 3.7.72.6 is not encrypted. This allows adjacent attackers to intercept the transmitted data. The vulnerability has a high severity rating with a CVSS score of 7. No official patch or remediation guidance has been provided yet.