Threats tagged 'ghsa-ghhg-w6h4-w3rm'

A hard-coded credential vulnerability (CWE-798) exists in the DJI AeroScope Mobile (TP703) firmware 03.00.00.26 and the 1300 communications board firmware versions 02.00.07.12 through 02.00.08.40. This flaw allows an attacker with physical access to the board's serial console to log in as root using a password that is the same across all units. The password hash uses DES crypt and can be recovered offline from the firmware. No network login service accepts this password by default. The affected products are no longer supported by DJI, and no firmware fix is available.