CVE-2023-6951
Raw vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:NSummary
CVE-2023-6951 is a medium-severity Small Space of Random Values (CWE-334) vulnerability in Nozominetworks (inferred from references). Its CVSS base score is 6.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-59147
Vulnerability Data
A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone’s Wi- Fi network. This, in…
more
turn, allows the attacker to perform unauthorized interaction with the network services exposed by the drone and to potentially decrypt the Wi-Fi traffic exchanged between the drone and the Android/IOS device of the legitimate user during QuickTransfer mode. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
IA-5 requires management of authenticator strength which includes ensuring random authenticators have adequate value space.
SC-12 requires proper cryptographic key generation which structurally demands a sufficiently large random value space.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require cryptographically strong RNGs with adequate value space, while fixing only this CWE addresses one narrow aspect of the control.
Authentication mechanisms often depend on random values (nonces, tokens), so the control can reduce exposure but eliminating the CWE does not achieve authentication outcomes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Cryptographic controls require adequate key/seed entropy, directly mitigating small random-value spaces.
Security testing can detect insufficient randomness in tokens, session IDs, or keys.
Secure-coding standards explicitly call for cryptographically strong random number generation.
Secure authentication mechanisms often rely on unpredictable tokens or nonces, so weak randomness undermines them.