{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2017-3209 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2017-3209 yet. Limit exposure of the affected software until one is available.","what":"CVE-2017-3209 is a high-severity vulnerability in DBPOWER U818A WiFi Quadcopter Drone, published on 24 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2017-3209 and fix it if it is affected.\n\nWhat it is: CVE-2017-3209 is a high-severity vulnerability in DBPOWER U818A WiFi Quadcopter Drone, published on 24 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2017-3209 in the wild and no public exploit code.\n\nAffected product: DBPOWER U818A WiFi Quadcopter Drone. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2017-3209/ (Markdown: https://insights.sbomify.com/CVE-2017-3209/index.md)","id":"CVE-2017-3209","markdown":"https://insights.sbomify.com/CVE-2017-3209/index.md","name":"CVE-2017-3209","record":{"aliases":["GHSA-72jv-6p52-859w"],"analysis":{"component_type":"iot_embedded","fix_type":"configuration_change","impacts":["data_read","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"WiFi quadcopter drone","requires_auth":"none","summary":"Attackers can access the drone's FTP server anonymously to read files or modify system files due to insecure default permissions.","user_interaction":"not_required","vuln_class":"misconfiguration"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"certcc","cpe":[{"product":"u818a_firmware","vendor":"dbpower"}],"cvss":{"score":8.1,"severity":"high","source":"nvd","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"},{"id":"CWE-276","name":"Incorrect Default Permissions"}],"description":"The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem read/write permissions to the anonymous user. A remote user within range of the open access point on the drone may utilize the anonymous user of the FTP server to read arbitrary files, such as images and video recorded by the device, or to replace system files such as /etc/shadow to gain further access to the device. Furthermore, the DBPOWER U818A WIFI quadcopter drone uses BusyBox 1.20.2, which was released in 2012, and may be vulnerable to other known BusyBox vulnerabilities.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Misconfiguration in U818A WiFi Quadcopter Drone","id":"CVE-2017-3209","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"misconfiguration","year":"2017"},"n_packages":0,"n_references":3,"next":{"headline":"Privilege escalation in SDK","id":"CVE-2017-3210"},"packages":[],"prev":{"headline":"XML external entity in n/a","id":"CVE-2017-3208"},"products":["U818A WiFi Quadcopter Drone"],"published":"2018-07-24","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-05","vendors":["DBPOWER"]},"summary":"Attackers can access the drone's FTP server anonymously to read files or modify system files due to insecure default permissions.","url":"https://insights.sbomify.com/CVE-2017-3209/"}