CVE-2022-46415 - OpenCVE

DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker would first need to connect to the device's internal Wi-Fi network (e.g., by guessing the password). Then, the attacker would need to send many DHCP request packets.

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Dji	Spark Firmware Spark

Configuration 1 [-]

AND

cpe:2.3:o:dji:spark_firmware:01.00.0900:*:*:*:*:*:*:*

cpe:2.3:h:dji:spark:-:*:*:*:*:*:*:*

References

Link	Resource
https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-54q2-3r2m-9pgm	Exploit Third Party Advisory
https://smartstore.naver.com/chachablues/products/6617613337	Product
https://smartstore.naver.com/hancomawesome-tech/products/5367473135	Product

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2023-03-27T00:00:00

Updated: 2023-03-27T00:00:00

Reserved: 2022-12-04T00:00:00

Link: CVE-2022-46415

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-03-27T21:15:10.047

Modified: 2023-04-03T17:04:17.763

Link: CVE-2022-46415

JSON object: View

Redhat Information

No data.

CWE

NVD-CWE-noinfo

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dji:spark_firmware:01.00.0900:*:*:*:*:*:*:*", "matchCriteriaId": "D43634EF-A329-4697-B9C8-CCCF1CE46105", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dji:spark:-:*:*:*:*:*:*:*", "matchCriteriaId": "994999FF-08F9-4491-A0FA-0A2AF083ADBA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker would first need to connect to the device's internal Wi-Fi network (e.g., by guessing the password). Then, the attacker would need to send many DHCP request packets."}], "id": "CVE-2022-46415", "lastModified": "2023-04-03T17:04:17.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.3, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2023-03-27T21:15:10.047", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-54q2-3r2m-9pgm"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://smartstore.naver.com/chachablues/products/6617613337"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://smartstore.naver.com/hancomawesome-tech/products/5367473135"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}