Executive brief
The SJRC F11 SJ-GPS-PRO is a consumer drone with embedded firmware containing a hardcoded remote command execution backdoor. An attacker on the drone's open WiFi network can send specially crafted TCP packets to port 8888 that execute arbitrary shell commands as root without any authentication, providing complete device control and potential access to sensitive data like GPS coordinates and camera feeds.
Technical details
This vulnerability is a hardcoded command injection flaw in the tcp_actions() function within the vs_play binary on the SJRC F11 firmware (build 2019-09-17). The vulnerable code checks if an incoming TCP packet on port 8888 begins with the bytes 0x64 0x61 ("da"), then passes the next 29 bytes directly to system() for execution with root privileges and no authentication checks. The attack vector is network-based and requires only access to the drone's open WiFi network (no WPA encryption), making exploitation trivial. An attacker can execute arbitrary commands as root, achieving full device compromise. The firmware is unpatched and based on a 2011-era Linux 3.0.8 kernel with known vulnerabilities.
Affected products
- SJRC F11 SJ-GPS-PRO firmware build 2019-09-17
Timeline
- 2026-05: other: Manufacturer notified by researcher Ashton Kopelevich (Texas A&M University)
- 2026-08-18: disclosed: Public disclosure via GitHub repository and CVE assignment
- 2026-05-17: other: Initial notification to SJRC