What’s Vulnerable › Vulnerabilities

CVE-2022-29945

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-29 · updated 2026-06-17
• Weakness: CWE-319

Description

DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol.

Affected products

• DJI Air 2 Firmware: all versions
• DJI Air 2S Firmware: all versions
• DJI Fhantom 4 Pro Firmware: all versions
• DJI Fpv Firmware: all versions
• DJI Inspire 2 Firmware: all versions
• DJI Mavic 3 Firmware: all versions
• DJI Mini 2 Firmware: all versions
• DJI Mini Se Firmware: all versions
• DJI Rc Pro Firmware: all versions
• DJI Zenmuse X5S Firmware: all versions
• DJI Zenmuse X7 Firmware: all versions

References

• https://twitter.com/StarFire2258/status/1519767091829637120
• https://twitter.com/d0tslash/status/1519774807776284672
• https://www.theverge.com/2022/4/28/23046916/dji-aeroscope-signals-not-encrypted-drone-tracking
• https://twitter.com/StarFire2258/status/1519767091829637120
• https://twitter.com/d0tslash/status/1519774807776284672
• https://www.theverge.com/2022/4/28/23046916/dji-aeroscope-signals-not-encrypted-drone-tracking

Get alerted when CVE-2022-29945 or the next vulnerability affects your stack