Threats tagged 'ghsa-qc72-xhr7-fx97'

An OS command injection vulnerability (CWE-78) exists in the network-configuration handling of the management service (uavmonitor_usbv1) on the 1300 communications board of DJI AeroScope Mobile (TP703) firmware 03.00.00.26 and board firmware versions 02.00.07.12 through 02.00.08.40. This flaw allows an unauthenticated attacker on the local network to execute arbitrary commands as root by sending crafted configuration values to TCP port 16000. The injected commands persist across reboots. The affected products are no longer supported and no firmware fixes are available.