Lucene search

[email protected]CVE-2022-29945

HistoryApr 29, 2022 - 8:15 p.m.

CVE-2022-29945

2022-04-2920:15:07

CWE-319

[email protected]

web.nvd.nist.gov

dji

drone

aeroscope

protocol

location

security vulnerability

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.6%

JSON

DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator’s physical location via the AeroScope protocol.

Affected configurations

NVD

Node

djimavic_3_firmwareMatch-

AND

djimavic_3Match-

Node

djirc_pro_firmwareMatch-

AND

djirc_proMatch-

Node

djiair_2s_firmwareMatch-

AND

djiair_2sMatch-

Node

djiair_2_firmwareMatch-

AND

djiair_2Match-

Node

djimini_2_firmwareMatch-

AND

djimini_2Match-

Node

djimini_se_firmwareMatch-

AND

djimini_seMatch-

Node

djifpv_firmwareMatch-

AND

djifpvMatch-

Node

djifhantom_4_pro_firmwareMatch-

AND

djifhantom_4_proMatch-

djifhantom_4_proMatch2.0

Node

djiinspire_2_firmwareMatch-

AND

djiinspire_2Match-

Node

djizenmuse_x7_firmwareMatch-

AND

djizenmuse_x7Match-

Node

djizenmuse_x5s_firmwareMatch-

AND

djizenmuse_x5sMatch-

CPENameOperatorVersion
dji:mavic_3_firmwaredji mavic 3 firmwareeq-

CPE	Name	Operator	Version
dji:mavic_3_firmware	dji mavic 3 firmware	eq	-

References

twitter.com/d0tslash/status/1519774807776284672

twitter.com/StarFire2258/status/1519767091829637120

www.theverge.com/2022/4/28/23046916/dji-aeroscope-signals-not-encrypted-drone-tracking

Social References

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.6%

JSON

Related for CVE-2022-29945

nvd1 cvelist1 prion1