# CVE-2017-3209: Misconfiguration in U818A WiFi Quadcopter Drone

> Attackers can access the drone's FTP server anonymously to read files or modify system files due to insecure default permissions.

- **Severity:** High 8.1 (`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 24 Jul 2018
- **Updated:** 5 Aug 2024
- **Also known as:** GHSA-72jv-6p52-859w

## What is CVE-2017-3209?

CVE-2017-3209 is a high-severity vulnerability in DBPOWER U818A WiFi Quadcopter Drone, published on 24 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem read/write permissions to the anonymous user. A remote user within range of the open access point on the drone may utilize the anonymous user of the FTP server to read arbitrary files, such as images and video recorded by the device, or to replace system files such as /etc/shadow to gain further access to the device. Furthermore, the DBPOWER U818A WIFI quadcopter drone uses BusyBox 1.20.2, which was released in 2012, and may be vulnerable to other known BusyBox vulnerabilities.

Weakness: CWE-306 (Missing Authentication for Critical Functionality), CWE-276 (Incorrect Default Permissions)

## Which versions are affected by CVE-2017-3209?

It affects 1 product.


Products: Dbpower U818a Firmware.

## How do I fix CVE-2017-3209?

No fix has been published for CVE-2017-3209 yet. Limit exposure of the affected software until one is available.

## Is CVE-2017-3209 being exploited?

There is no known exploitation of CVE-2017-3209 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2017-3209 and fix it if it is affected.

What it is: CVE-2017-3209 is a high-severity vulnerability in DBPOWER U818A WiFi Quadcopter Drone, published on 24 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2017-3209 in the wild and no public exploit code.

Affected product: DBPOWER U818A WiFi Quadcopter Drone. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2017-3209/ (Markdown: https://insights.sbomify.com/CVE-2017-3209/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2017-3209
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-3209
- OSV: https://osv.dev/vulnerability/CVE-2017-3209

---
From sbomify Insights: https://insights.sbomify.com/CVE-2017-3209/
Summaries are generated and may contain mistakes; the official description above is the record.