CVE-2026-1289088.8HighCWE-78

CVE-2026-128908: DJI AeroScope Mobile: OS command injection leads to root code execution

DJI · AeroScope Mobile (TP703)

Affected: DJI AeroScope Mobile (TP703) · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.9%probability of exploitation in the next 30 days

79th percentile

050100

Higher than 79% of scored CVEs

8.8HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

OS command injection (CWE-78) in the network-configuration handling of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to execute arbitrary commands as root. Configuration values that can be written without authentication over the management interface are inserted unquoted into shell commands. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. The injected command persists across reboots. Confirmed on a physical device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.

Affected products2

From the CVE record. A product or version that is not listed is unknown, not unaffected.

DJI · AeroScope Mobile (TP703)03.00.00.26
DJI · AeroScope Mobile (TP703) 1300 communications board firmwarefrom 02.00.07.12 up to and including 02.00.08.40

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: OS Command Injection · Command and Code Injection
Vendor: DJI
Published: November 2026
Band: Possible (1 to 10%), November 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-128908 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.