What is the CVSS score of CVE-2022-29945?

CVE-2022-29945 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.7%.

Mavic 3 Firmware CVE-2022-29945

HIGH

Cleartext Transmission of Sensitive Information (CWE-319)

2022-04-29 cve@mitre.org

Information Disclosure Mavic 3 Firmware Rc Pro Firmware Air 2S Firmware Air 2 Firmware Mini 2 Firmware Mini Se Firmware Fpv Firmware Fhantom 4 Pro Firmware Inspire 2 Firmware Zenmuse X7 Firmware Zenmuse X5S Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Apr 29, 2022 - 20:15 nvd

HIGH 7.5

DescriptionNVD

DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol.

AnalysisAI

DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-319. DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol. Affected products include: Dji Mavic 3 Firmware, Dji Rc Pro Firmware, Dji Air 2S Firmware, Dji Air 2 Firmware, Dji Mini 2 Firmware. Version information: through 2022.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.