The 1300 communications board of the DJI AeroScope Mobile (TP703) ships with a hard-coded root password (CWE-798). The same hash in /etc/shadow is present on every unit and uses DES crypt (CWE-916, CWE-521), so the password can be recovered offline from the distributed firmware. An attacker with physical access to the board’s serial console can then log in as root. No network login service accepts this password by default. Confirmed on a physical device.

Because the credential is image-wide rather than per-device, a single recovery applies to every affected unit and an operator cannot contain a leak.

AeroScope Mobile is end-of-life (EOL) and no longer supported by DJI.