CVE-2020-29664

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-02-18 · updated 2026-06-17
Weakness: CWE-78

Description

A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a malicious firmware upgrade packet.

Affected products

DJI Mavic 2 Firmware: before 01.00.0510 — fixed in 01.00.0510

How to fix

Upgrade to a fixed version: DJI Mavic 2 Firmware 01.00.0510. Check the vendor advisory for mitigations.

References

http://hacktheplanet.nu/djihax.pdf
http://kth.diva-portal.org/smash/get/diva2:1463784/FULLTEXT01.pdf
https://gist.github.com/viktoredstrom/2f0463ebe7cd786904f229e11386e817
https://www.dji.com/mavic-2
http://hacktheplanet.nu/djihax.pdf
http://kth.diva-portal.org/smash/get/diva2:1463784/FULLTEXT01.pdf
https://gist.github.com/viktoredstrom/2f0463ebe7cd786904f229e11386e817
https://www.dji.com/mavic-2

Get alerted when CVE-2020-29664 or the next vulnerability affects your stack