Read the docs
TI-2023-28110 Aliases CVE-2023-51456GHSA-5mr8-wmmr-33q3

Out-of-bounds read in DJI Mavic 3 Pro

Priority LOW 32CWE-125Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to trigger an out-of-bound read/write into the process memory through a crafted payload due to a missing input sanity check in the v2_pack_array_to_msg function implemented in the libv2_sdk.so library imported by the v2_sdk_service binary implementing the service, potentially leading to a memory information leak or an arbitrary code execution. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00245 15th percentileScored 2026-11-07
Fix Fixed Mavic 3 Pro (DJI): 01.01.0300Mavic 3 (DJI): 01.00.1200+5 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DJIMavic 3 Probefore 01.01.030001.01.0300Patch availableCNA
DJIMavic 3before 01.00.120001.00.1200Patch availableCNA
DJIMavic 3 Classicbefore 01.00.050001.00.0500Patch availableCNA
DJIMavic 3 Enterprisebefore 7.01.10.037.01.10.03Patch availableCNA
DJIMatrice 300before 57.00.01.0057.00.01.00Patch availableCNA
DJIMatrice M30before 07.01.002207.01.0022Patch availableCNA
DJIMini 3 Probefore 01.00.062001.00.0620Patch availableCNA
  • Mavic 3 Pro VendorDJI Affected before 01.01.0300 Fixed in 01.01.0300 Patch available CNA
  • Mavic 3 VendorDJI Affected before 01.00.1200 Fixed in 01.00.1200 Patch available CNA
  • Mavic 3 Classic VendorDJI Affected before 01.00.0500 Fixed in 01.00.0500 Patch available CNA
  • Mavic 3 Enterprise VendorDJI Affected before 7.01.10.03 Fixed in 7.01.10.03 Patch available CNA
  • Matrice 300 VendorDJI Affected before 57.00.01.00 Fixed in 57.00.01.00 Patch available CNA
  • Matrice M30 VendorDJI Affected before 07.01.0022 Fixed in 07.01.0022 Patch available CNA
  • Mini 3 Pro VendorDJI Affected before 01.00.0620 Fixed in 01.00.0620 Patch available CNA

CPE names CISA-ADP · 5

CPEVersionsRoleVendor
cpe:2.3:o:dji:mavic_3_pro_firmware:*:*:*:*:*:*:*:*——DJI
cpe:2.3:o:dji:matrice_m30_firmware:*:*:*:*:*:*:*:*——DJI
cpe:2.3:o:dji:matrice_300_firmware:*:*:*:*:*:*:*:*——DJI
cpe:2.3:o:dji:mavic_3_firmware:*:*:*:*:*:*:*:*——DJI
cpe:2.3:o:dji:mini_3_pro_firmware:*:*:*:*:*:*:*:*——DJI
  • cpe:2.3:o:dji:mavic_3_pro_firmware:*:*:*:*:*:*:*:* Versions — — ·DJI
  • cpe:2.3:o:dji:matrice_m30_firmware:*:*:*:*:*:*:*:* Versions — — ·DJI
  • cpe:2.3:o:dji:matrice_300_firmware:*:*:*:*:*:*:*:* Versions — — ·DJI
  • cpe:2.3:o:dji:mavic_3_firmware:*:*:*:*:*:*:*:* Versions — — ·DJI
  • cpe:2.3:o:dji:mini_3_pro_firmware:*:*:*:*:*:*:*:* Versions — — ·DJI

Remediation

  • Fix · CNA Mavic 3 Pro (DJI) Fixed in 01.01.0300
  • Fix · CNA Mavic 3 (DJI) Fixed in 01.00.1200
  • Fix · CNA Mavic 3 Classic (DJI) Fixed in 01.00.0500
  • Fix · CNA Mavic 3 Enterprise (DJI) Fixed in 7.01.10.03
  • Fix · CNA Matrice 300 (DJI) Fixed in 57.00.01.00
  • Fix · CNA Matrice M30 (DJI) Fixed in 07.01.0022
  • Fix · CNA Mini 3 Pro (DJI) Fixed in 01.00.0620

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    DJI Matrice 300, Matrice M30 and 5 more products 01.00.0500, 01.00.0620 and 5 more versions

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2023-28109 Improper array index validation in DJI Mavic 3 ProPriority LOW 32
    • TI-2023-28108 Out-of-bounds write in DJI Mavic 3 ProPriority LOW 32
    • TI-2023-06354 A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of…Priority LOW 29
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-51456
  2. 2026-10-03 Alias added: GHSA-5mr8-wmmr-33q3

References

Other 1

  • TI-2007-01042 Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted… CVSS 2.0HIGH 9.3
  • TI-2026-54424 DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory CVSS 4.0CRITICAL 9.3
  • TI-2026-54428 DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media CVSS 4.0HIGH 8.7
  • TI-2026-79886 Missing authentication in DJI CrystalSky ZS600C ADB daemon CVSS 4.0CRITICAL 9.3
  • TI-2026-79884 OS command injection in DJI CrystalSky ZS600C hardware_monitor CVSS 4.0HIGH 8.6
  • TI-2026-54192 Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE CVSS 4.0CRITICAL 9.4
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences