CVE-2026-52481: SJRC F11 Information Disclosure Flaw

CVE-2026-52481 Overview

CVE-2026-52481 is an information disclosure vulnerability in the SJRC F11 SJ-GPS-PRO drone firmware build dated 2019-09-17. The flaw resides in the tcp_actions() function, which improperly exposes sensitive data to unauthenticated remote attackers over the network. The weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Exploitation requires no authentication, no user interaction, and low attack complexity. A public proof-of-concept exists in the GitHub PoC Repository.

Critical Impact
Remote unauthenticated attackers can retrieve sensitive information from affected SJRC F11 SJ-GPS-PRO devices by interacting with the exposed tcp_actions() handler.

Affected Products

SJRC F11 SJ-GPS-PRO drone
Firmware build 2019-09-17
Devices exposing the tcp_actions() TCP service to reachable networks

Discovery Timeline

2026-08-18 - CVE-2026-52481 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-52481

Vulnerability Analysis

The SJRC F11 SJ-GPS-PRO is a consumer GPS-equipped drone that exposes a TCP-based control and telemetry interface. The firmware build dated 2019-09-17 implements a tcp_actions() handler that processes remote requests without adequately restricting which data it returns to the caller. A remote attacker who can reach the device on its TCP service can invoke this function and receive sensitive information back from the drone.

The vulnerability is categorized as [CWE-200], indicating exposure of sensitive information to an unauthorized actor. The confidentiality impact is high, while integrity and availability are not affected. Public technical details and reproduction steps are hosted in the GitHub PoC Repository. The EPSS probability for this CVE is 0.375% as of 2026-08-20.

Root Cause

The root cause is missing authorization and improper output filtering inside the tcp_actions() function. The function accepts network requests and returns internal device state or configuration data without verifying the requester's identity or scoping the response. Because the drone's TCP service is reachable without credentials, any client with network access is treated as a trusted peer.

Attack Vector

The attack vector is network-based. An attacker on the same Wi-Fi network as the drone, or otherwise able to route TCP traffic to it, sends crafted requests to the port serviced by tcp_actions(). The handler responds with sensitive information disclosed by the firmware. No authentication, credentials, or user interaction are required.

No verified exploit code is reproduced here. See the GitHub PoC Repository for the researcher's proof-of-concept and reproduction details.

Detection Methods for CVE-2026-52481

Indicators of Compromise

Unsolicited TCP connections to the SJRC F11 SJ-GPS-PRO drone from unknown clients on the local wireless network.
Outbound responses from the drone containing configuration, telemetry, or identifier data sent to non-owner endpoints.
Traffic patterns matching the request payloads documented in the public PoC repository.

Detection Strategies

Capture and inspect Wi-Fi traffic between control devices and the drone for anomalous request/response pairs targeting the tcp_actions() service port.
Baseline normal client behavior of the vendor's mobile application and alert on deviations from that request signature.
Monitor for scanners probing consumer drone ports on operator networks and correlate with device MAC addresses matching SJRC hardware.

Monitoring Recommendations

Log wireless client associations to any access point that also hosts the drone and review for unauthorized peers.
Use network intrusion detection signatures aligned with the PoC request format to flag exploitation attempts.
Track firmware versions of deployed drones and treat build 2019-09-17 as vulnerable until replaced.

How to Mitigate CVE-2026-52481

Immediate Actions Required

Do not operate the SJRC F11 SJ-GPS-PRO on shared or untrusted wireless networks.
Isolate the drone's control network from other clients and from the internet.
Restrict access to the drone's Wi-Fi SSID using a strong pre-shared key and disable broadcast where possible.

Patch Information

No vendor patch or updated firmware has been referenced in the NVD entry for CVE-2026-52481. Consult SJRC directly for firmware updates superseding build 2019-09-17. Until a fixed build is confirmed, treat all deployments on this firmware as vulnerable.

Workarounds

Power the drone off when not in active use to eliminate the exposed TCP service window.
Operate the device only in physically controlled areas where hostile Wi-Fi clients are unlikely to be present.
Place the controller and drone on an isolated network segment with no bridging to corporate or home LANs.

bash

# Configuration example: block inbound traffic to the drone's subnet from other VLANs
iptables -A FORWARD -s 0.0.0.0/0 -d 192.168.42.0/24 -j DROP
iptables -A FORWARD -s 192.168.42.0/24 -d 0.0.0.0/0 -j DROP