CVE-2023-6951

MEDIUM Year: 2023
CVSS v3 Score
6.6
Medium
Weakness Type
CWE-334
View all →

Vulnerability Description

A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone’s Wi- Fi network. This, in turn, allows the attacker to perform unauthorized interaction with the network services exposed by the drone and to potentially decrypt the Wi-Fi traffic exchanged between the drone and the Android/IOS device of the legitimate user during QuickTransfer mode. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.

Related Vulnerabilities

CVE-2020-7566

HIGH
CVSS:7.3(High)

A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption keys when the attacker has captured th...

CWE-3342020

CVE-2022-22517

HIGH
CVSS:7.5(High)

An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel...

CWE-3342022

CVE-2022-24402

HIGH
CVSS:7.5(High)

The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystream generation phase, which is insufficie...

CWE-3342022

CVE-2021-21955

HIGH
CVSS:7.7(High)

An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. Generic network sniffing can lead to passwor...

CWE-3342021

CVE-2022-20941

MEDIUM
CVSS:5.3(Medium)

A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to access sensitive information. This vulnerab...

CWE-3342022

CVE-2022-33707

MEDIUM
CVSS:5.3(Medium)

Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device.

CWE-3342022