The firmware update handler of the unauthenticated management service (uavmonitor_usbv1, see CVE-2026-128907) on the 1300 communications board of the DJI AeroScope Mobile (TP703) does not verify a cryptographic signature (CWE-347, CWE-494). It accepts any image that matches an MD5 checksum supplied in the same request, so an unauthenticated attacker on the local network can install modified firmware and gain persistent code execution as root.

Exploitation requires network access to TCP port 16000 on the board and is possible only while no other host is controlling the board. Reproduced by running the unmodified device binaries in emulation; not tested on a physical device.

AeroScope Mobile is end-of-life (EOL) and no longer supported by DJI.