CVE-2023-6949 Vulnerability Details

  /     /     /  

CVE-2023-6949 Metadata Quick Info

CVE Published: 02/04/2024 | CVE Updated: 27/08/2024 | CVE Year: 2023
Source: Nozomi | Vendor: DJI | Product: Mini 3 Pro
Status : PUBLISHED

---

CVE-2023-6949 Description

A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an attacker to enumerate and download videos and pictures saved on the drone internal or external memory without requiring any kind of authentication.

Metrics

CVSS Version: 3.1 | Base Score: 5.2 MEDIUM
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)* ADJACENT_NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* LOW
    User Interaction (UI)* REQUIRED
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* NONE
    Availability Impact (A)* NONE

Weakness Enumeration (CWE)

CWE-ID: CWE-306
CWE Name: CWE-306 Missing Authentication for Critical Function
Source: DJI

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).