The network-configuration handling of the management service (uavmonitor_usbv1) on the 1300 communications board of the DJI AeroScope Mobile (TP703) inserts configuration values unquoted into shell commands (CWE-78). Because these values can be written without authentication over the management interface (see CVE-2026-128907), an unauthenticated attacker on the local network can execute arbitrary commands as root. The injected command persists across reboots.

Exploitation requires network access to TCP port 16000 on the board and is possible only while no other host is controlling the board. Confirmed on a physical device.

AeroScope Mobile is end-of-life (EOL) and no longer supported by DJI.