Unscored CVE-2020-29664 EUVD-2020-22021GHSA-f4jc-6jgg-x3mc

A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a ma…

Published Feb 18, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Description

A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a malicious firmware upgrade packet.

References

http://hacktheplanet.nu/djihax.pdf
http://kth.diva-portal.org/smash/get/diva2:1463784/FULLTEXT01.pdf
https://www.dji.com/mavic-2
https://gist.github.com/viktoredstrom/2f0463ebe7cd786904f229e11386e817