The management service (uavmonitor_usbv1) on the 1300 communications board of the DJI AeroScope Mobile (TP703) accepts commands in DJI’s proprietary DUML protocol without any authentication (CWE-306). An unauthenticated attacker on the local network can read device information such as the serial number, MAC address, IP address and radio configuration, and change configuration settings. The same commands are also accepted over the USB operator port.

Exploitation requires network access to TCP port 16000 on the board and is possible only while no other host is controlling the board. Confirmed on a physical device.

AeroScope Mobile is end-of-life (EOL) and no longer supported by DJI.