{"id":"CVE-2023-6951","aliases":["EUVD-2023-59147","GHSA-f74c-6mfp-rg2q"],"status":"published","title":"A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI...","description":"A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone’s Wi- Fi network. This, in turn, allows the attacker to perform unauthorized interaction with the network services exposed by the drone and to potentially decrypt the Wi-Fi traffic exchanged between the drone and the Android/IOS device of the legitimate user during QuickTransfer mode. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.","severity":{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00288,"percentile":0.21501,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1391","CWE-334"],"published":"2024-04-02T10:28:05Z","modified":"2026-06-17T06:51:45Z","products":[{"vendor":"dji","product":"matrice 300"},{"vendor":"dji","product":"matrice m30"},{"vendor":"dji","product":"mavic 3"},{"vendor":"dji","product":"mavic 3 classic"},{"vendor":"dji","product":"mavic 3 enterprise"},{"vendor":"dji","product":"mavic 3 pro"},{"vendor":"dji","product":"mini 3 pro"}],"references":[{"url":"https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6951/","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6951"},{"url":"https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6951"},{"url":"https://github.com/advisories/GHSA-f74c-6mfp-rg2q"}],"sources":{"cve":[{"id":"CVE-2023-6951","description":"A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone’s Wi- Fi network. This, in turn, allows the attacker to perform unauthorized interaction with the network services exposed by the drone and to potentially decrypt the Wi-Fi traffic exchanged between the drone and the Android/IOS device of the legitimate user during QuickTransfer mode. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.","status":"published","published":"2024-04-02T10:28:05.544Z","modified":"2024-09-30T10:04:13.991Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-334"],"updated_at":"2026-11-02T14:35:25.469654Z"}],"euvd":[{"id":"EUVD-2023-59147","description":"A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone’s Wi- Fi network. This, in turn, allows the attacker to perform unauthorized interaction with the network services exposed by the drone and to potentially decrypt the Wi-Fi traffic exchanged between the drone and the Android/IOS device of the legitimate user during QuickTransfer mode. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.","status":"published","published":"2024-04-02T10:28:05Z","modified":"2024-09-30T10:04:13Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:28:03.921663Z"}],"ghsa":[{"id":"GHSA-f74c-6mfp-rg2q","title":"A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI...","description":"A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone’s Wi- Fi network. This, in turn, allows the attacker to perform unauthorized interaction with the network services exposed by the drone and to potentially decrypt the Wi-Fi traffic exchanged between the drone and the Android/IOS device of the legitimate user during QuickTransfer mode. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.","status":"published","published":"2024-04-02T12:30:32Z","modified":"2024-09-30T12:31:39Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-334","CWE-1391"],"updated_at":"2026-11-02T14:58:22.484222Z"}],"nvd":[{"id":"CVE-2023-6951","description":"A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone’s Wi- Fi network. This, in turn, allows the attacker to perform unauthorized interaction with the network services exposed by the drone and to potentially decrypt the Wi-Fi traffic exchanged between the drone and the Android/IOS device of the legitimate user during QuickTransfer mode. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.","status":"published","published":"2024-04-02T11:15:51.417Z","modified":"2026-06-17T06:51:45.237Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-334"],"updated_at":"2026-11-02T14:09:10.192572Z"}]}}