CVE-2020-29664

HIGH

DJI Mavic 2 Remote Controller <1.00.0510 - Command Injection

Title source: llm
STIX 2.1

Description

A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a malicious firmware upgrade packet.

References (4)

Core 4
Core References
Exploit, Third Party Advisory x_refsource_misc
http://hacktheplanet.nu/djihax.pdf
Technical Description, Third Party Advisory x_refsource_misc
http://kth.diva-portal.org/smash/get/diva2:1463784/FULLTEXT01.pdf
Product x_refsource_misc
https://www.dji.com/mavic-2

Scores

CVSS v3 7.8
EPSS 0.0149
EPSS Percentile 70.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (1)
dji/mavic_2_firmware < 01.00.0510
Published Feb 18, 2021
Tracked Since Feb 18, 2026