CVE-2023-6951

MEDIUM

6.6

CVSS Score

Published: April 2, 2024 at 10:28 AM UTC

Updated: June 17, 2026 at 06:51 AM UTC

7 products affected across 1 vendorMini 3 ProMavic 3Mavic 3 Pro

Using Mavic 3 Pro by DJI?

Get instant alerts when new vulnerabilities affect Mavic 3 Pro - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.6

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone’s Wi- Fi network. This, in turn, allows the attacker to perform unauthorized interaction with the network services exposed by the drone and to potentially decrypt the Wi-Fi traffic exchanged between the drone and the Android/IOS device of the legitimate user during QuickTransfer mode. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Matrice 300 · Dji

60%

v < 57.00.01.00

Affected range stops below 57.00.01.00, so it looks safe — our inference, not a vendor statement

Matrice M30 · Dji

60%

v < 07.01.0022

Affected range stops below 07.01.0022, so it looks safe — our inference, not a vendor statement

Mavic 3 · Dji

60%

v < 01.00.1200

Affected range stops below 01.00.1200, so it looks safe — our inference, not a vendor statement

Mavic 3 Classic · Dji

60%

v < 1.00.0500

Affected range stops below 1.00.0500, so it looks safe — our inference, not a vendor statement

Mavic 3 Enterprise · Dji

60%

v < 7.01.10.03

Affected range stops below 7.01.10.03, so it looks safe — our inference, not a vendor statement

Mavic 3 Pro · Dji

60%

v < 01.01.0300

Affected range stops below 01.01.0300, so it looks safe — our inference, not a vendor statement

Mini 3 Pro · Dji

60%

v < 01.00.0620

Affected range stops below 01.00.0620, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

Source: [email protected]

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6951/

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.6MEDIUMNozomi

Attack Vector: ADJACENT_NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: REQUIRED
Scope: CHANGED
Confidentiality: HIGH
Integrity: NONE
Availability: NONE

Vector?

Quick Info

StatusDEFERRED

CWE

CWE-334

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card