Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-29945: DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol.

CVE-2022-29945 · published 4 years ago

Summary

DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
dji	mavic_3_firmware	All versions `cpe:2.3:o:dji:mavic_3_firmware:-:::::::*`
dji	rc_pro_firmware	All versions `cpe:2.3:o:dji:rc_pro_firmware:-:::::::*`
dji	air_2s_firmware	All versions `cpe:2.3:o:dji:air_2s_firmware:-:::::::*`
dji	air_2_firmware	All versions `cpe:2.3:o:dji:air_2_firmware:-:::::::*`
dji	mini_2_firmware	All versions `cpe:2.3:o:dji:mini_2_firmware:-:::::::*`
dji	mini_se_firmware	All versions `cpe:2.3:o:dji:mini_se_firmware:-:::::::*`
dji	fpv_firmware	All versions `cpe:2.3:o:dji:fpv_firmware:-:::::::*`
dji	fhantom_4_pro_firmware	All versions `cpe:2.3:o:dji:fhantom_4_pro_firmware:-:::::::*`
dji	inspire_2_firmware	All versions `cpe:2.3:o:dji:inspire_2_firmware:-:::::::*`
dji	zenmuse_x7_firmware	All versions `cpe:2.3:o:dji:zenmuse_x7_firmware:-:::::::*`
dji	zenmuse_x5s_firmware	All versions `cpe:2.3:o:dji:zenmuse_x5s_firmware:-:::::::*`

Original advisory text

DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol.

References

https://twitter.com/StarFire2258/status/1519767091829637120 Third Party Advisory
https://twitter.com/d0tslash/status/1519774807776284672 Third Party Advisory
https://www.theverge.com/2022/4/28/23046916/dji-aeroscope-signals-not-encrypted-... Press/Media Coverage Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-319Cleartext Transmission of Sensitive Information

Timeline

Published29 Apr 2022

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2022-29945 · NVD

Track software like this

Free during beta