Read the docs
TI-2023-06351 Aliases CVE-2023-6948GHSA-9mjv-vwjg-r37p

Buffer overflow in DJI Mavic 3 Pro

Priority LOW 19CWE-120Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

A Buffer Copy without Checking Size of Input issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash of the service through a crafted payload triggering a missing input size check in the sdk_printf function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk binary implementing the service, compromising it in a term of availability and producing a denial-of-service attack. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0021 11th percentileScored 2026-11-07
Fix Fixed Mavic 3 Pro (DJI): 01.01.0300Mavic 3 (DJI): 01.00.1200+5 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DJIMavic 3 Probefore 01.01.030001.01.0300Patch availableCNA
DJIMavic 3before 01.00.120001.00.1200Patch availableCNA
DJIMavic 3 Classicbefore 01.00.050001.00.0500Patch availableCNA
DJIMavic 3 Enterprisebefore 7.01.10.037.01.10.03Patch availableCNA
DJIMatrice 300before 57.00.01.0057.00.01.00Patch availableCNA
DJIMatrice M30before 07.01.002207.01.0022Patch availableCNA
DJIMini 3 Probefore 01.00.062001.00.0620Patch availableCNA
  • Mavic 3 Pro VendorDJI Affected before 01.01.0300 Fixed in 01.01.0300 Patch available CNA
  • Mavic 3 VendorDJI Affected before 01.00.1200 Fixed in 01.00.1200 Patch available CNA
  • Mavic 3 Classic VendorDJI Affected before 01.00.0500 Fixed in 01.00.0500 Patch available CNA
  • Mavic 3 Enterprise VendorDJI Affected before 7.01.10.03 Fixed in 7.01.10.03 Patch available CNA
  • Matrice 300 VendorDJI Affected before 57.00.01.00 Fixed in 57.00.01.00 Patch available CNA
  • Matrice M30 VendorDJI Affected before 07.01.0022 Fixed in 07.01.0022 Patch available CNA
  • Mini 3 Pro VendorDJI Affected before 01.00.0620 Fixed in 01.00.0620 Patch available CNA

Remediation

  • Fix · CNA Mavic 3 Pro (DJI) Fixed in 01.01.0300
  • Fix · CNA Mavic 3 (DJI) Fixed in 01.00.1200
  • Fix · CNA Mavic 3 Classic (DJI) Fixed in 01.00.0500
  • Fix · CNA Mavic 3 Enterprise (DJI) Fixed in 7.01.10.03
  • Fix · CNA Matrice 300 (DJI ) Fixed in 57.00.01.00
  • Fix · CNA Matrice M30 (DJI) Fixed in 07.01.0022
  • Fix · CNA Mini 3 Pro (DJI) Fixed in 01.00.0620

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    DJI Matrice 300, Matrice M30 and 5 more products 01.00.0500, 01.00.0620 and 5 more versions

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2023-28110 Out-of-bounds read in DJI Mavic 3 ProPriority LOW 32
    • TI-2023-28109 Improper array index validation in DJI Mavic 3 ProPriority LOW 32
    • TI-2023-28108 Out-of-bounds write in DJI Mavic 3 ProPriority LOW 32
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-6948
  2. 2026-10-03 Alias added: GHSA-9mjv-vwjg-r37p

References

Other 1

  • TI-2007-01042 Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted… CVSS 2.0HIGH 9.3
  • TI-2026-54424 DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory CVSS 4.0CRITICAL 9.3
  • TI-2026-54428 DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media CVSS 4.0HIGH 8.7
  • TI-2026-79886 Missing authentication in DJI CrystalSky ZS600C ADB daemon CVSS 4.0CRITICAL 9.3
  • TI-2026-79884 OS command injection in DJI CrystalSky ZS600C hardware_monitor CVSS 4.0HIGH 8.6
  • TI-2026-54192 Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE CVSS 4.0CRITICAL 9.4
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences