Medium severity · published Apr 2, 2024
CVE-2023-6949
A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an attacker to enumerate…
5.2
CVSS
0.2%
EPSS
No
On KEV
Description
A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an attacker to enumerate and download videos and pictures saved on the drone internal or external memory without requiring any kind of authentication.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
M3
Mini 3 Pro · DJI
before 01.00.1200 · source: vendor
M3
Mini 3 Pro Firmware · Dji
before 01.00.1200 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-6949
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-6949
www.nozominetworks.com
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6949/
More from Mini 3 Pro
9.4
CVE-2026-77812
Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE
9.3
CVE-2026-78251
DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory
8.7
CVE-2026-78255
DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media
8.5
CVE-2026-78306
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
6.8
CVE-2023-51456
A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to trigger an out-of-bound…