QuickTransfer Wi-Fi credential derivation

1. Summary

The Wi-Fi access point that DJI drones expose in QuickTransfer Mode is protected by a WPA2 pre-shared key that the on-device dji_network service generates from a weak scheme: an 8-character hexadecimal string built from four libc random calls, fixed at first boot [1][3]. The resulting keyspace is only a little over four billion combinations, small enough to brute-force offline in roughly two hours on a single GPU [3]. An attacker within Wi-Fi range of a drone whose QuickTransfer Mode is active can capture the WPA2 handshake, recover the PSK, and join the drone’s network without authorization [1][3]. Network access then serves as a foothold to reach media and other unauthenticated drone services [3][6].

2. Affected products & versions

Source: [1][2]. Whether models beyond this list share the same static-PSK primitive is not documented in the reviewed sources.

3. The vulnerability in detail

QuickTransfer Mode is a convenience feature: when a DJI drone is on the ground and not flying, the user can activate it so the aircraft stands up a WPA2-protected Wi-Fi access point that a mobile device connects to for fast download of photos and video [1][3]. That access point is the attack surface. The security of the whole feature rests on the secrecy and unpredictability of one value — the WPA2 pre-shared key protecting the AP — and that is exactly the value that is generated badly [1][3].

The defect lives in the drone’s own operating system, which is Android-based, inside the dji_network service binary at /system/bin/dji_network [3][4]. Within that binary, the function generate_default_passwd is responsible for producing the AP’s password. Rather than drawing from a cryptographically secure random source and producing a high-entropy key, the function calls libc random four times and assembles an 8-character password from the hexadecimal charset [0-9a-f] [3]. Two properties of this design make it fatal. First, the alphabet and length are tiny: eight positions drawn from sixteen possible characters yield only a little more than four billion (16^8 ≈ 4.29 × 10^9) possible passwords — a search space that is trivial by modern cracking standards [3]. Second, the password is generated once, at initial boot, and then remains unchanged for the life of that boot session; it is static, not rotated per connection or per session, so an attacker has a stable target to crack and reuse [3].

This is a textbook instance of two related weakness classes. CWE-334, “Small Space of Random Values,” captures the core problem: the range of values the generator can produce is so small that an attacker can enumerate all of them [1][5]. CWE-1391, “Use of Weak Credentials,” captures the consequence at the protocol level: the credential guarding the Wi-Fi network is weak enough to be recovered rather than genuinely secret [5]. The GitHub advisory records both; NVD records CWE-334 [1][5]. Importantly, the weakness is about the size and stability of the value, not merely its algorithm — even if random produced uniformly distributed output, eight hex characters is simply too little material.

The mechanism to trigger and exploit it is straightforward given the preconditions. WPA2-PSK networks are vulnerable to offline dictionary/brute-force attacks because an attacker who captures the four-way handshake between a client and the AP can test candidate PSKs offline against the captured handshake, with no further interaction with the target. Here, the “dictionary” is the entire keyspace, and the entire keyspace is only four billion entries. The Nozomi researcher demonstrated that cracking took around two hours on a single Nvidia T4 GPU on a cloud instance, with a worst case near four hours [3]. That is the whole cryptographic barrier: a couple of GPU-hours.

The exploitation chain runs as follows [1][3][6]:

1. The attacker positions within Wi-Fi/RF range of a target DJI drone — an adjacent-network position, not remote internet reach (this is why CVSS scores it AV:A) [1].
2. The drone is on the ground and QuickTransfer Mode is activated, which requires a user action; this causes the drone to expose its WPA2 access point [1][3].
3. The attacker captures the WPA2 four-way handshake from the drone’s AP.
4. The attacker brute-forces the PSK offline against the ~4-billion-combination keyspace produced by generate_default_passwd; roughly two hours on one Nvidia T4 GPU [3].
5. Using the recovered static PSK, the attacker authenticates to and joins the drone’s Wi-Fi network without permission [1].
6. With network access, the attacker pivots to sibling services: CVE-2023-6949, an unauthenticated HTTP media-download API for exfiltrating photos and video; CVE-2023-6950, an open/unauthenticated FTP service; and vtwo_sdk services flagged as candidates for potential code execution [3][6].

Preconditions worth emphasizing: the attacker needs RF adjacency (AV:A), the drone must be grounded with QuickTransfer active (which requires user interaction, UI:R), and the target must run a vulnerable firmware version [3]. No prior authentication or privileges are needed (PR:N) [1].

Proof-of-concept status: the Nozomi write-up establishes practical feasibility with a concrete, measured crack time, demonstrating the attack as feasible by the discoverer [3].

4. Discovery & timeline

The vulnerability is credited to Niccolo’ (Nicolo) Facchi of Nozomi Networks Labs [2]. It emerged from a two-part reverse-engineering effort against DJI Mavic 3 firmware: Part 1 established the methodology and attack surface — defeating certificate pinning in the DJI Fly Android app, intercepting firmware-download credentials, and decrypting firmware packages with published keys via dji-firmware-tools — and Part 2 carried out the QuickTransfer vulnerability analysis that surfaced the weak-PSK defect [3][4]. The Nozomi advisory carries an issue/publication date of March 29, 2024, and CVE-2023-6951 was assigned by Nozomi Networks acting as CNA [2]. The finding was part of a coordinated disclosure of nine QuickTransfer-mode vulnerabilities; DJI resolved seven and disputed two as not requiring fixes [6]. A precise date-by-date disclosure timeline (report date, vendor acknowledgment, individual patch-release dates) is not provided in the reviewed sources.

5. Technical reference

• CVE: CVE-2023-6951 [1].
• CWE: CWE-334 (Small Space of Random Values) [1][5]; CWE-1391 (Use of Weak Credentials) [5].
• CVSS v3.1: base score 6.6 (MEDIUM); vector AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N [1][2][7].
• AV:A (Adjacent) — the attacker must be within Wi-Fi/RF range, not on the open internet.
• AC:L / PR:N — once in range and the AP is up, no special conditions and no privileges are required.
• UI:R (Required) — a user must activate QuickTransfer, which is what exposes the AP.
• S:C (Scope Changed) — the vulnerable component (the Wi-Fi credential service) impacts resources beyond its own security authority (the drone’s other network services).
• C:H / I:N / A:N — impact is confidentiality-only: recovering the key exposes the network and its data, but the CVSS metric asserts no direct integrity or availability impact.
• Code reference: generate_default_passwd in /system/bin/dji_network [3]. No specific commit or patch diff is published; the fix is delivered as per-model firmware images [2][3].

6. Consequence & CFSE path analysis

Real-world consequence: an attacker sitting within Wi-Fi range of a grounded drone that has QuickTransfer active can, after a couple of GPU-hours of offline cracking, get onto the drone’s private network. From there the immediate, concrete harm is to confidentiality — the drone’s transferred media and recordings, its service state, and (via the network foothold) its live video, navigation, and telemetry streams become reachable [1][3][6]. For an autonomous aircraft, exposure of the real-time sensor/perception stream is materially more serious than “a Wi-Fi password was weak” suggests, because it reveals what the aircraft is seeing and where it is operating.

This is why the CFSE Path Score diverges from the CVSS baseline. The published CVSS v3.1 score is 6.6 MEDIUM — a number driven down by adjacency (AV:A) and the confidentiality-only impact triad (C:H/I:N/A:N), which flattens what confidentiality is lost. CFSE instead decomposes the entry into two consequence paths and scores by what the compromised data actually means for an autonomous vehicle:

• PERCEPTION_PRIVACY (dominant path) — CRITICAL. An adjacent-network attacker within Wi-Fi range derives the weak PSK and decrypts/accesses live video, navigation, and telemetry, exposing the aircraft’s real-time perception and operational world state (DP4/CRITICAL). Authority remains bounded to network confidentiality (AT2, PH0) with no control-plane pivot demonstrated.
• DATA_PRIVACY (supporting path) — HIGH. The derived key gives a foothold on drone network services and access to transferred media/recordings and service state (DP3), distinct from the live perception stream.

Both paths note that the derivation weakness is a shared, fleet-wide primitive (SR4) — the same flawed generate_default_passwd design ships across models — but exploitation is proximity-bound per target (SX2): each victim must be individually approached within RF range, and the AP must be up. Remediation is available by firmware update (OR2 / LS PATCH_AVAILABLE).

Overall path verdict: CRITICAL, direction UNDER relative to the published CVSS v3.1 baseline of 6.6 MEDIUM. The divergence is driven by the perception-privacy consequence for an autonomous vehicle’s sensor stream, which the CVSS confidentiality metric cannot express.

7. Remediation & mitigations

• Primary fix — firmware upgrade. DJI released firmware updates addressing this and most of the nine QuickTransfer findings. Upgrade each affected model to at least its fixed version: Mavic 3 Pro 01.01.0300; Mavic 3 01.00.1200; Mavic 3 Classic 01.00.0500; Mavic 3 Enterprise 07.01.10.03; Matrice 300 57.00.01.00; Matrice M30 07.01.0022; Mini 3 Pro 01.00.0620 [1][2].
• Operational mitigation specific to this bug. The AP is only exposed when the drone is grounded and QuickTransfer Mode is activated by the user [1][3]. On unpatched aircraft, avoiding QuickTransfer Mode (transferring media via a wired path or SD card instead) removes the exposed access point and therefore the attack surface entirely.
• Note on residual exposure. Sibling issue CVE-2023-6950 (open/unauthenticated FTP) was disputed by DJI as not requiring a fix, so operators should not assume every QuickTransfer network service is remediated by the firmware update; the network foothold remains valuable if reachable [6].
• No additional vendor-documented workaround beyond firmware upgrade is detailed in the advisory [2].

8. Sources

[1] NVD - CVE-2023-6951 - NIST NVD - https://nvd.nist.gov/vuln/detail/CVE-2023-6951 - Authoritative CVE record: weak-credentials description, CVSS 6.6 vector, affected models/firmware, CWE-334. Credibility: primary advisory. [2] CVE-2023-6951 | Nozomi Networks Labs (Vendor Advisory) - Nozomi Networks - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6951 - Originating researcher advisory: discoverer credit, per-model fix versions, CVSS vector, issue date March 29 2024, firmware-upgrade mitigation. Credibility: researcher-primary. [3] DJI Mavic 3 Drone Research Part 2: Vulnerability Analysis - Nozomi Networks Labs - https://www.nozominetworks.com/blog/dji-mavic-3-drone-research-part-2-vulnerability-analysis - Technical root-cause deep-dive: generate_default_passwd, four random calls, ~4B keyspace, static-after-boot, ~2h crack on one T4 GPU, post-access pivot. Credibility: researcher-primary. [4] DJI Mavic 3 Drone Research Part 1: Firmware Analysis - Nozomi Networks Labs - https://www.nozominetworks.com/blog/dji-mavic-3-drone-research-part-1-firmware-analysis - Firmware reverse-engineering methodology and attack surface (Android OS, cert-pinning bypass, firmware decryption) that led to the finding. Credibility: researcher-primary. [5] CVE-2023-6951 - GitHub Advisory Database (GHSA-f74c-6mfp-rg2q) - GitHub - https://github.com/advisories/GHSA-f74c-6mfp-rg2q - Structured advisory adding dual CWE classification (CWE-334 and CWE-1391), CVSS vector, and fix versions. Credibility: primary advisory. [6] Wi-Fi Flaws in DJI Mavic 3 Allow Attackers to Hack the Drone - CyberInsider - https://cyberinsider.com/wi-fi-flaws-in-dji-mavic-3-allow-attackers-to-hack-the-drone/ - Context of the nine QuickTransfer flaws (seven fixed, two disputed), sibling CVE-2023-6949 and CVE-2023-6950, DJI’s response. Credibility: reputable press. [7] CVE-2023-6951 : Use of Weak Credentials vulnerability - CVEdetails (SecurityScorecard) - https://www.cvedetails.com/cve/CVE-2023-6951/ - Aggregated datasheet restating description, CVSS 6.6 scoring, affected product/firmware list, Nozomi as assigning source. Credibility: reputable press / aggregator cross-check.