CVE-2022-46415

DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker would first need to connect to the device's internal Wi-Fi network (e.g., by guessing the password). Then, the attacker would need to send many DHCP request packets.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 5.3

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-54q2-3r2m-9pgm	Exploit Third Party Advisory
https://smartstore.naver.com/chachablues/products/6617613337	Product
https://smartstore.naver.com/hancomawesome-tech/products/5367473135	Product
https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-54q2-3r2m-9pgm	Exploit Third Party Advisory
https://smartstore.naver.com/chachablues/products/6617613337	Product
https://smartstore.naver.com/hancomawesome-tech/products/5367473135	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:dji:spark_firmware:01.00.0900:*:*:*:*:*:*:*

cpe:2.3:h:dji:spark:-:*:*:*:*:*:*:*

History

21 Nov 2024, 07:30

Type	Values Removed	Values Added
References	~~() https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-54q2-3r2m-9pgm - Exploit, Third Party Advisory~~	() https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-54q2-3r2m-9pgm - Exploit, Third Party Advisory
References	~~() https://smartstore.naver.com/chachablues/products/6617613337 - Product~~	() https://smartstore.naver.com/chachablues/products/6617613337 - Product
References	~~() https://smartstore.naver.com/hancomawesome-tech/products/5367473135 - Product~~	() https://smartstore.naver.com/hancomawesome-tech/products/5367473135 - Product
CVSS	v2 : ~~unknown~~ v3 : ~~5.9~~	v2 : unknown v3 : 9.1

Information

Published : 2023-03-27 21:15

Updated : 2024-11-21 07:30

NVD link : CVE-2022-46415

Mitre link : CVE-2022-46415

CVE.ORG link : CVE-2022-46415

JSON object : View

Products Affected

dji

spark
spark_firmware

CWE

NVD-CWE-noinfo

{"id": "CVE-2022-46415", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 5.3, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2023-03-27T21:15:10.047", "references": [{"url": "https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-54q2-3r2m-9pgm", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://smartstore.naver.com/chachablues/products/6617613337", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://smartstore.naver.com/hancomawesome-tech/products/5367473135", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-54q2-3r2m-9pgm", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://smartstore.naver.com/chachablues/products/6617613337", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://smartstore.naver.com/hancomawesome-tech/products/5367473135", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker would first need to connect to the device's internal Wi-Fi network (e.g., by guessing the password). Then, the attacker would need to send many DHCP request packets."}], "lastModified": "2024-11-21T07:30:33.673", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dji:spark_firmware:01.00.0900:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D43634EF-A329-4697-B9C8-CCCF1CE46105"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dji:spark:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "994999FF-08F9-4491-A0FA-0A2AF083ADBA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}