Is CVE-2023-6951 actively exploited?

No active exploitation of CVE-2023-6951 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-6951 be exploited remotely?

Partially. CVE-2023-6951 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2023-6951?

CVE-2023-6951 has a CVSS score of 6.6 (MEDIUM).

HOME VULNERABILITIESCVE-2023-6951

MEDIUM

CVE-2023-6951

CWE-334Published: April 2, 2024· Updated: Jun 17, 2026

6.6

CVSS v3.1

Official Description

A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone’s Wi- Fi network. This, in turn, allows the attacker to perform unauthorized interaction with the network services exposed by the drone and to potentially decrypt the Wi-Fi traffic exchanged between the drone and the Android/IOS device of the legitimate user during QuickTransfer mode. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.

NVD Source

Technical Analysis

CVE-2023-6951 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.6.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.