CVE-2017-3209 Misconfiguration in U818A WiFi Quadcopter Drone
Attackers can access the drone's FTP server anonymously to read files or modify system files due to insecure default permissions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-3209?
CVE-2017-3209 is a high-severity vulnerability in DBPOWER U818A WiFi Quadcopter Drone, published on 24 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem read/write permissions to the anonymous user. A remote user within range of the open access point on the drone may utilize the anonymous user of the FTP server to read arbitrary files, such as images and video recorded by the device, or to replace system files such as /etc/shadow to gain further access to the device. Furthermore, the DBPOWER U818A WIFI quadcopter drone uses BusyBox 1.20.2, which was released in 2012, and may be vulnerable to other known BusyBox vulnerabilities.
Which versions are affected by CVE-2017-3209?
It affects 1 product.
Products include Dbpower U818a Firmware.
How do I fix CVE-2017-3209?
No fix has been published for CVE-2017-3209 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-3209 being exploited?
There is no known exploitation of CVE-2017-3209 in the wild and no public exploit code.
Sources
Also known as GHSA-72jv-6p52-859w.