How severe is CVE-2022-46415?

CVE-2022-46415 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability high.

Is CVE-2022-46415 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-46415?

CVE-2022-46415 affects Dji Spark Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-46415?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2022-46415 published?

CVE-2022-46415 was published on 2023-03-27 and last updated on 2026-06-17.

CVE-2022-46415

CVE-2022-46415 is a critical-severity vulnerability in Dji Spark Firmware with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-291.

Key facts

Severity: Critical (CVSS 3.x base score 9.1)
EPSS exploit prediction: 1% (56th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-291
Affected product: Dji Spark Firmware
Published: 2023-03-27
Last modified: 2026-06-17

Description

DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker would first need to connect to the device's internal Wi-Fi network (e.g., by guessing the password). Then, the attacker would need to send many DHCP request packets.

Frequently asked questions

What is CVE-2022-46415?: DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker would first need to connect to the device's internal Wi-Fi network (e.g., by guessing the password). Then, the attacker would need to send many DHCP request packets.
How severe is CVE-2022-46415?: CVE-2022-46415 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability high.
Is CVE-2022-46415 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-46415?: CVE-2022-46415 affects Dji Spark Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-46415?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2022-46415 published?: CVE-2022-46415 was published on 2023-03-27 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:dji:spark_firmware:01.00.0900:*:*:*:*:*:*:*

More vulnerabilities in Dji Spark Firmware

CVE-2026-26673 — High (CVSS 7.5): An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a…

All CVEs affecting Dji Spark Firmware →

Other CWE-291 vulnerabilities

CVE-2025-66602 — Critical (CVSS 9.8): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server…
CVE-2024-23309 — Critical (CVSS 9.0): The LevelOne WBR-6012 router with firmware R0.40e6 has an authentication bypass vulnerability in its web application…
CVE-2025-34202 — High (CVSS 8.8): Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 (VA…
CVE-2025-59101 — High (CVSS 7.7): Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has…
CVE-2026-3690 — High (CVSS 7.4): OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass…
CVE-2023-35906 — Medium (CVSS 5.3): IBM Aspera Faspex 5.0.5 could allow a remote attacked to bypass IP restrictions due to improper access controls. IBM…

Browse all CWE-291 vulnerabilities →