Is CVE-2026-52480 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52480 being exploited in the wild.

How severe is CVE-2026-52480?

Medium severity, with a CVSS score of 6.5, published 18 August 2026.

Which products and versions are affected?

SJRC F11 SJ-GPS-PRO firmware build 2019-09-17.

Is there a fix for CVE-2026-52480?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-52480 attacked?

It is attacked from the adjacent network.

Am I affected by CVE-2026-52480?

Check whether you run SJRC F11 SJ-GPS-PRO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52480: SJRC F11 SJ-GPS-PRO unauthenticated FTP information disclosure

CVE-2026-52480 · Severity: medium · CVSS 6.5 · Published 2026-08-18

The SJRC F11 SJ-GPS-PRO consumer drone runs an FTP server accessible over its open WiFi network with no password protection. An attacker within WiFi range can connect to the drone and download sensitive files including firmware without any authentication, potentially exposing system configurations and enabling further exploitation.

Technologies: SJRC F11 SJ-GPS-PRO. Vendors: SJRC.

Quick answers

Is CVE-2026-52480 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52480 being exploited in the wild.
How severe is CVE-2026-52480?: Medium severity, with a CVSS score of 6.5, published 18 August 2026.
Which products and versions are affected?: SJRC F11 SJ-GPS-PRO firmware build 2019-09-17.
Is there a fix for CVE-2026-52480?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-52480 attacked?: It is attacked from the adjacent network.
Am I affected by CVE-2026-52480?: Check whether you run SJRC F11 SJ-GPS-PRO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authentication issue (CWE-306) in the inetd service, which spawns an FTP daemon (/sbin/ftpd) on TCP port 21 without requiring credentials. The attack surface is the drone's unencrypted open WiFi access point (172.16.10.1), which assigns DHCP addresses to connected clients. An unauthenticated attacker within WiFi range can access the FTP service and retrieve arbitrary files including firmware images. No authentication or user interaction is required; the inetd service is enabled by default. No patch has been released by the vendor (SJRC), and the issue remains unpatched in firmware build 2019-09-17.

Affected products

SJRC F11 SJ-GPS-PRO firmware build 2019-09-17

Timeline

2026-08-15: disclosed: Public disclosure by Ashton Kopelevich, Texas A&M University
2026-05-17: other: Vendor SJRC notified via contact form

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.