Is CVE-2017-3209 actively exploited?

No active exploitation of CVE-2017-3209 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2017-3209 be exploited remotely?

Partially. CVE-2017-3209 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2017-3209?

CVE-2017-3209 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2017-3209

HIGH

CVE-2017-3209

CWE-276Published: July 24, 2018· Updated: Jun 17, 2026

8.1

CVSS v3.1

Official Description

The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem read/write permissions to the anonymous user. A remote user within range of the open access point on the drone may utilize the anonymous user of the FTP server to read arbitrary files, such as images and video recorded by the device, or to replace system files such as /etc/shadow to gain further access to the device. Furthermore, the DBPOWER U818A WIFI quadcopter drone uses BusyBox 1.20.2, which was released in 2012, and may be vulnerable to other known BusyBox vulnerabilities.

NVD Source

Technical Analysis

CVE-2017-3209 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 8.1.