Executive brief
The SJRC F11 SJ-GPS-PRO consumer drone runs an FTP server accessible over its open WiFi network with no password protection. An attacker within WiFi range can connect to the drone and download sensitive files including firmware without any authentication, potentially exposing system configurations and enabling further exploitation.
Technical details
The vulnerability is a missing authentication issue (CWE-306) in the inetd service, which spawns an FTP daemon (/sbin/ftpd) on TCP port 21 without requiring credentials. The attack surface is the drone's unencrypted open WiFi access point (172.16.10.1), which assigns DHCP addresses to connected clients. An unauthenticated attacker within WiFi range can access the FTP service and retrieve arbitrary files including firmware images. No authentication or user interaction is required; the inetd service is enabled by default. No patch has been released by the vendor (SJRC), and the issue remains unpatched in firmware build 2019-09-17.
Affected products
- SJRC F11 SJ-GPS-PRO firmware build 2019-09-17
Timeline
- 2026-08-15: disclosed: Public disclosure by Ashton Kopelevich, Texas A&M University
- 2026-05-17: other: Vendor SJRC notified via contact form