CVE-2022-29945

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://twitter.com/StarFire2258/status/1519767091829637120Third Party Advisory
https://twitter.com/d0tslash/status/1519774807776284672Third Party Advisory
https://www.theverge.com/2022/4/28/23046916/dji-aeroscope-signals-not-encrypted-drone-trackingPress/Media Coverage, Third Party Advisory
https://twitter.com/StarFire2258/status/1519767091829637120Third Party Advisory
https://twitter.com/d0tslash/status/1519774807776284672Third Party Advisory
https://www.theverge.com/2022/4/28/23046916/dji-aeroscope-signals-not-encrypted-drone-trackingPress/Media Coverage, Third Party Advisory

Timeline

Published: Apr 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-299466.3NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by CVE-2022-299476.1Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.CVE-2022-299484.6Due to an insecure design, the Lepin EP-KP001 flash drive through KP001_V19 is vulnerable to an authentication bypass attack that enables an CVE-2022-29957.1Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data CVE-2022-299504.3Experian Hunter 1.16 allows remote authenticated users to modify assumed-immutable elements via the (1) rule name parameter to the Rules pag CVE-2022-299519.1JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. They utilize the CMPLink/TCP protocol (configurable on ports 1024-65534 on e CVE-2022-299529.1Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (6 CVE-2022-299539.8The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocum CVE-2022-299577.8The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols CVE-2022-299589.8JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering pu CVE-2022-299595.5Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave and Bristol Babcock l CVE-2022-29967.4A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified.