CVE-2023-6949

CVSS V2 None CVSS V3 None

Description

A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an attacker to enumerate and download videos and pictures saved on the drone internal or external memory without requiring any kind of authentication.

Overview

CVE ID
CVE-2023-6949

Assigner
Nozomi

Vulnerability Status
PUBLISHED

Published Version
2024-04-02T10:27:44.079Z

Last Modified Date
2024-04-02T10:27:44.079Z

Weakness Enumerations

CWE	URL
CWE-306	http://cwe.mitre.org/data/definitions/306.html

References

Reference URL	Reference Tags
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6949/

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-6949
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6949

History

Created	Old Value	New Value	Data Type	Notes
2024-06-25 06:39:59				Added to TrackCVE