CVE-2023-6949CWE-306

A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an…

Medium · published April 2, 2024

CVSS v3.1
5.2
EPSS
0%
Percentile
13.8
In the wild
Unconfirmed
What it is

A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an attacker to enumerate and download videos and pictures saved on the drone internal or external memory without requiring any kind of authentication.

The record
Technical detail
CVSS v3.1
5.2 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00236 · 13.8th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2024-04-02T10:27Z
EPSS history
Timeline
  • 02 APR 10:27Z
    A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an…
    cvelistv5