CVE-2017-3209

Name of the Vulnerable Software and Affected Versions: DBPOWER U818A WIFI quadcopter drone (affected versions not specified)

Description: The issue concerns the DBPOWER U818A WIFI quadcopter drone, which provides FTP access over its local access point and allows full file permissions to the anonymous user. This enables a remote user within range to access the drone's FTP server without a password and read or modify arbitrary files, including system files. The drone uses an outdated version of BusyBox, which may increase its vulnerability to known exploits.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.