Search
Find a vulnerability
Search criteria
49 vulnerabilities by dji
CVE-2026-114357 (GCVE-0-2026-114357)
Vulnerability from nvd – Published: 2026-10-23 13:39 – Updated: 2026-10-23 13:39
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)
Summary
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).
Severity
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or \u0027setprop persist.adb.tcp.port 5555\u0027), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).\u003c/p\u003e"
}
],
"value": "Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or \u0027setprop persist.adb.tcp.port 5555\u0027), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3)."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Unauthenticated shell over USB by default (and over the network if ADB-over-TCP is enabled); foothold for escalation to root."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "ADB-over-TCP enabled (non-default): network-reachable"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:39:28.510Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114357",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114357"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114357",
"datePublished": "2026-10-23T13:39:28.510Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:39:28.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114356 (GCVE-0-2026-114356)
Vulnerability from nvd – Published: 2026-10-23 13:37 – Updated: 2026-10-23 13:37
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
Summary
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authorization in the system-privileged \u0027DJIUpdateService\u0027 binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.\u003c/p\u003e"
}
],
"value": "Missing authorization in the system-privileged \u0027DJIUpdateService\u0027 binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Local zero-permission application triggers destructive privileged operations (factory reset/wipe, shutdown) and the firmware-apply hand-off."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:37:34.059Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114356",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114356"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114356",
"datePublished": "2026-10-23T13:37:34.059Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:37:34.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114355 (GCVE-0-2026-114355)
Vulnerability from nvd – Published: 2026-10-23 13:35 – Updated: 2026-10-23 13:35
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root
Summary
OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.
Severity
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOS command injection in the root-privileged \u0027hardware_monitor\u0027 helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.\u003c/p\u003e"
}
],
"value": "OS command injection in the root-privileged \u0027hardware_monitor\u0027 helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Local unprivileged process escalates to root via attacker-controlled log content."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:35:42.796Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114355",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114355"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114355",
"datePublished": "2026-10-23T13:35:42.796Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:35:42.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114354 (GCVE-0-2026-114354)
Vulnerability from nvd – Published: 2026-10-23 13:33 – Updated: 2026-10-23 13:33
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
Summary
Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authorization in the native binder service \u0027android.dji.server\u0027 (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged \u0027assistant\u0027 daemon without any caller-identity or permission check.\u003c/p\u003e"
}
],
"value": "Missing authorization in the native binder service \u0027android.dji.server\u0027 (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged \u0027assistant\u0027 daemon without any caller-identity or permission check."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Local zero-permission application gains arbitrary command execution as root."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:33:36.131Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114354",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114354"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114354",
"datePublished": "2026-10-23T13:33:36.131Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:33:36.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114353 (GCVE-0-2026-114353)
Vulnerability from nvd – Published: 2026-10-23 13:31 – Updated: 2026-10-23 13:31
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution
Summary
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().
Severity
CWE
- CWE-912 - Hidden Functionality
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eHidden functionality (undocumented backdoor) in the root-privileged \u0027assistant\u0027 daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string \u0027dji26656677\u0027 to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().\u003c/p\u003e"
}
],
"value": "Hidden functionality (undocumented backdoor) in the root-privileged \u0027assistant\u0027 daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string \u0027dji26656677\u0027 to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system()."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Unauthenticated root-level command execution over the USB serial interface."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:31:05.598Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114353",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114353"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114353",
"datePublished": "2026-10-23T13:31:05.598Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:31:05.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78251 (GCVE-0-2026-78251)
Vulnerability from nvd – Published: 2026-08-24 07:04 – Updated: 2026-08-27 16:23
VLAI
EPSS
VEX
Title
DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory
Summary
DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An attacker with access to the drone's internal network or USB RNDIS interface can exhaust the available storage, preventing the aircraft from writing flight records, logs, and telemetry and potentially preventing subsequent firmware updates. Uploaded files persist across reboot and factory reset.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 16:53 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.dji.com/help/content?customId=en-… | product |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Neo |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Neo 2 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Flip |
Affected:
0 , ≤ 01.00.1200
(semver)
|
|
| DJI | Air 3 |
Affected:
0 , ≤ 01.00.1600
(semver)
|
|
| DJI | Air 3S |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Avata 2 |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Avata 360 |
Affected:
0 , ≤ 01.00.0300
(semver)
|
|
| DJI | Mavic 3 |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Mavic 3 Classic |
Affected:
0 , ≤ 01.00.0800
(semver)
|
|
| DJI | Mavic 3 Pro |
Affected:
0 , ≤ 01.01.0700
(semver)
|
|
| DJI | Mavic 4 Pro |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 2 |
Affected:
0 , ≤ 01.07.0200
(semver)
|
|
| DJI | Mini 3 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 3 Pro |
Affected:
0 , ≤ 01.00.0900
(semver)
|
|
| DJI | Mini 4 Pro |
Affected:
0 , ≤ 01.00.1100
(semver)
|
|
| DJI | Mini 5 Pro |
Affected:
0 , ≤ 01.00.0600
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78251",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T16:53:34.972831Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T16:53:46.387Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Neo",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neo 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Flip",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3S",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 360",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0300",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Classic",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0800",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.01.0700",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.07.0200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0900",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1100",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 5 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdelrahman Yousef"
},
{
"lang": "en",
"type": "finder",
"value": "Dr. Jordan Samhi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An attacker with access to the drone\u0027s internal network or USB RNDIS interface can exhaust the available storage, preventing the aircraft from writing flight records, logs, and telemetry and potentially preventing subsequent firmware updates. Uploaded files persist across reboot and factory reset.\u003cbr\u003e\u003cbr\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003cbr\u003e\u003cbr\u003eRemediation requires a firmware update from the vendor.\u0026nbsp;\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An attacker with access to the drone\u0027s internal network or USB RNDIS interface can exhaust the available storage, preventing the aircraft from writing flight records, logs, and telemetry and potentially preventing subsequent firmware updates. Uploaded files persist across reboot and factory reset.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\nRemediation requires a firmware update from the vendor."
}
],
"impacts": [
{
"capecId": "CAPEC-560",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-560 Use of Known Domain Credentials"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T16:23:12.462Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"product"
],
"url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-78251",
"datePublished": "2026-08-24T07:04:32.474Z",
"dateReserved": "2026-08-24T07:02:39.767Z",
"dateUpdated": "2026-08-27T16:23:12.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78321 (GCVE-0-2026-78321)
Vulnerability from nvd – Published: 2026-08-24 08:47 – Updated: 2026-08-24 12:51
VLAI
EPSS
VEX
Title
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
Summary
The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling legitimate requests and causing a denial of service that prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 12:31 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.dji.com/help/content?customId=en-… | product |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Neo |
Affected:
0 , ≤ 01.00.0400,
(semver)
|
|
| DJI | Neo 2 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Flip |
Affected:
0 , ≤ 01.00.1200
(semver)
|
|
| DJI | Air 3 |
Affected:
0 , ≤ 01.00.1600
(semver)
|
|
| DJI | Air 3S |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Avata 2 |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Avata 360 |
Affected:
0 , ≤ 01.00.0300
(semver)
|
|
| DJI | Mavic 3 |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Mavic 3 Classic |
Affected:
0 , ≤ 01.00.0800
(semver)
|
|
| DJI | Mavic 3 Pro |
Affected:
0 , ≤ 01.01.0700
(semver)
|
|
| DJI | Mavic 4 Pro |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 2 |
Affected:
0 , ≤ 01.07.0200,
(semver)
|
|
| DJI | Mini 3 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 3 Pro |
Affected:
0 , ≤ 01.00.0900
(semver)
|
|
| DJI | Mini 4 Pro |
Affected:
0 , ≤ 01.00.1100
(semver)
|
|
| DJI | Mini 5 Pro |
Affected:
0 , ≤ 01.00.0600
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78321",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T12:31:40.529460Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T12:51:11.340Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Neo",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400,",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neo 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Flip",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3S",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 360",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0300",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Classic",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0800",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.01.0700",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.07.0200,",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0900",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1100",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 5 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdelrahman Yousef"
},
{
"lang": "en",
"type": "finder",
"value": "Dr. Jordan Samhi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone\u0027s internal network can exhaust the server\u0027s connection pool by repeatedly requesting a stored media file, preventing the server from handling legitimate requests and causing a denial of service that prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode.\u003cbr\u003e\u003cbr\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003cbr\u003e\u003cbr\u003eRemediation requires a firmware update from the vendor.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone\u0027s internal network can exhaust the server\u0027s connection pool by repeatedly requesting a stored media file, preventing the server from handling legitimate requests and causing a denial of service that prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\nRemediation requires a firmware update from the vendor."
}
],
"impacts": [
{
"capecId": "CAPEC-469",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-469 HTTP DoS"
}
]
},
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125 Flooding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T08:47:11.796Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"product"
],
"url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-78321",
"datePublished": "2026-08-24T08:47:11.796Z",
"dateReserved": "2026-08-24T08:46:02.862Z",
"dateUpdated": "2026-08-24T12:51:11.340Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78306 (GCVE-0-2026-78306)
Vulnerability from nvd – Published: 2026-08-24 08:08 – Updated: 2026-10-12 12:09
VLAI
EPSS
VEX
Title
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
Summary
DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone's internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator's wireless control, video, and telemetry connections during flight.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 12:31 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://support.dji.com/help/content?customId=en-… | product |
| https://github.com/Wh02m1/CVE-2026-78306 | technical-description |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Neo |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Neo 2 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Flip |
Affected:
0 , ≤ 01.00.1200
(semver)
|
|
| DJI | Air 3 |
Affected:
0 , ≤ 01.00.1600
(semver)
|
|
| DJI | Air 3S |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Avata 2 |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Avata 360 |
Affected:
0 , ≤ 01.00.0300
(semver)
|
|
| DJI | Mavic 3 |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Mavic 3 Classic |
Affected:
0 , ≤ 01.00.0800
(semver)
|
|
| DJI | Mavic 3 Pro |
Affected:
0 , ≤ 01.01.0700
(semver)
|
|
| DJI | Mavic 4 Pro |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 2 |
Affected:
0 , ≤ 01.07.0200
(semver)
|
|
| DJI | Mini 3 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 3 Pro |
Affected:
0 , ≤ 01.00.0900
(semver)
|
|
| DJI | Mini 4 Pro |
Affected:
0 , ≤ 01.00.1100
(semver)
|
|
| DJI | Mini 5 Pro |
Affected:
0 , ≤ 01.00.0600
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78306",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T12:31:53.968074Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T12:51:11.501Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Neo",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neo 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Flip",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3S",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 360",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0300",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Classic",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0800",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.01.0700",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.07.0200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0900",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1100",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 5 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdelrahman Yousef"
},
{
"lang": "en",
"type": "finder",
"value": "Dr. Jordan Samhi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone\u0027s internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator\u0027s wireless control, video, and telemetry connections during flight.\u003cbr\u003e\u003cbr\u003e\u003cdiv\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003c/div\u003e\u003cbr\u003eRemediation requires a firmware update from the vendor.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone\u0027s internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator\u0027s wireless control, video, and telemetry connections during flight.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\n\nRemediation requires a firmware update from the vendor."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T12:09:08.628Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"product"
],
"url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Wh02m1/CVE-2026-78306"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1-2026-20018"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-78306",
"datePublished": "2026-08-24T08:08:00.485Z",
"dateReserved": "2026-08-24T08:07:50.044Z",
"dateUpdated": "2026-10-12T12:09:08.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78255 (GCVE-0-2026-78255)
Vulnerability from nvd – Published: 2026-08-24 07:25 – Updated: 2026-08-24 16:32
VLAI
EPSS
VEX
Title
DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media
Summary
The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator's routines.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 16:31 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.dji.com/help/content?customId=en-… | product |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Neo |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Neo 2 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Flip |
Affected:
0 , ≤ 01.00.1200
(semver)
|
|
| DJI | Air 3 |
Affected:
0 , ≤ 01.00.1600,
(semver)
|
|
| DJI | Air 3S |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Avata 2 |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Avata 360 |
Affected:
0 , ≤ 01.00.0300
(semver)
|
|
| DJI | Mavic 3 |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Mavic 3 Classic |
Affected:
0 , ≤ 01.00.0800
(semver)
|
|
| DJI | Mavic 3 Pro |
Affected:
0 , ≤ 01.01.0700
(semver)
|
|
| DJI | Mavic 4 Pro |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 2 |
Affected:
0 , ≤ 01.07.0200
(semver)
|
|
| DJI | Mini 3 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 3 Pro |
Affected:
0 , ≤ 01.00.0900
(semver)
|
|
| DJI | Mini 4 Pro |
Affected:
0 , ≤ 01.00.1100
(semver)
|
|
| DJI | Mini 5 Pro |
Affected:
0 , ≤ 01.00.0600
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78255",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T16:31:56.561456Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T16:32:27.348Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Neo",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neo 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Flip",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1600,",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3S",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 360",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0300",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Classic",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0800",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.01.0700",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.07.0200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0900",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1100",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 5 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdelrahman Yousef"
},
{
"lang": "en",
"type": "finder",
"value": "Dr. Jordan Samhi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone\u0027s internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator\u0027s routines.\u003cbr\u003e\u003cbr\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone\u0027s internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator\u0027s routines.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600."
}
],
"impacts": [
{
"capecId": "CAPEC-87",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-87 Forceful Browsing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T07:25:24.159Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"product"
],
"url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-78255",
"datePublished": "2026-08-24T07:25:24.159Z",
"dateReserved": "2026-08-24T07:25:18.359Z",
"dateUpdated": "2026-08-24T16:32:27.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77812 (GCVE-0-2026-77812)
Vulnerability from nvd – Published: 2026-08-21 14:06 – Updated: 2026-10-12 12:14
VLAI
EPSS
VEX
Title
Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE
Summary
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.
* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network
* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.
* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely
* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed
* A BLE sniffer and presence during one normal DJI Fly connection are needed
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 17:42 UTC
CWE
- CWE-311 - Missing Encryption of Sensitive Data
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://support.dji.com/help/content?customId=en-… | technical-description |
| https://github.com/Wh02m1/CVE-2026-77812 | technical-description |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Neo |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Neo 2 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | DJI Flip |
Affected:
0 , ≤ 01.00.1200
(semver)
|
|
| DJI | Air 3 |
Affected:
0 , ≤ 01.00.1600
(semver)
|
|
| DJI | Air 3S |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Avata 2 |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Avata 360 |
Affected:
0 , ≤ 01.00.0300
(semver)
|
|
| DJI | Mavic 3 |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Mavic 3 Classic |
Affected:
0 , ≤ 01.00.0800
(semver)
|
|
| DJI | Mavic 3 Pro |
Affected:
0 , ≤ 01.01.0700
(semver)
|
|
| DJI | Mavic 4 Pro |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 2 |
Affected:
0 , ≤ 01.07.0200
(semver)
|
|
| DJI | Mini 3 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 3 Pro |
Affected:
0 , ≤ 01.00.0900
(semver)
|
|
| DJI | Mini 4 Pro |
Affected:
0 , ≤ 01.00.1100
(semver)
|
|
| DJI | Mini 5 Pro |
Affected:
0 , ≤ 01.00.0600
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77812",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T17:42:02.404909Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T17:42:36.191Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Neo",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neo 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DJI Flip",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3S",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 360",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0300",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Classic",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0800",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.01.0700",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.07.0200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0900",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1100",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 5 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdelrahman Yousef"
},
{
"lang": "en",
"type": "finder",
"value": "Dr. Jordan Samhi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone\u0027s Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone\u0027s internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.\u003cbr\u003e\u003cbr\u003e* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone\u0027s network \u003cbr\u003e* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.\u003cbr\u003e* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely\u003cbr\u003e* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed\u003cbr\u003e* A BLE sniffer and presence during one normal DJI Fly connection are needed\u003cbr\u003e\u003cbr\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003cbr\u003e\u003cbr\u003eRemediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading."
}
],
"value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone\u0027s Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone\u0027s internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.\n\n* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone\u0027s network \n* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.\n* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely\n* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed\n* A BLE sniffer and presence during one normal DJI Fly connection are needed\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\nRemediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-311",
"description": "CWE-311 Missing Encryption of Sensitive Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T12:14:20.097Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Wh02m1/CVE-2026-77812"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1-2026-20157"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-77812",
"datePublished": "2026-08-21T14:06:55.723Z",
"dateReserved": "2026-08-21T14:06:52.579Z",
"dateUpdated": "2026-10-12T12:14:20.097Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1743 (GCVE-0-2026-1743)
Vulnerability from nvd – Published: 2026-02-02 04:02 – Updated: 2026-02-23 09:13
VLAI
EPSS
VEX
Title
DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay
Summary
A vulnerability has been found in DJI Mavic Mini, Air, Spark and Mini SE up to 01.00.0500. Affected by this vulnerability is an unknown functionality of the component Enhanced Wi-Fi Pairing. The manipulation leads to authentication bypass by capture-replay. The attack must be carried out from within the local network. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-03 14:32 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.343674 | vdb-entry |
| https://vuldb.com/?ctiid.343674 | signaturepermissions-required |
| https://vuldb.com/?submit.741323 | third-party-advisory |
| https://github.com/ByteMe1001/DJI-CatNect | related |
| https://github.com/ByteMe1001/DJI-CatNect/blob/ma… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1743",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T14:32:25.302924Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T15:32:46.738Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Enhanced Wi-Fi Pairing"
],
"product": "Mavic Mini",
"vendor": "DJI",
"versions": [
{
"status": "affected",
"version": "01.00"
}
]
},
{
"modules": [
"Enhanced Wi-Fi Pairing"
],
"product": "Air",
"vendor": "DJI",
"versions": [
{
"status": "affected",
"version": "01.00"
}
]
},
{
"modules": [
"Enhanced Wi-Fi Pairing"
],
"product": "Spark",
"vendor": "DJI",
"versions": [
{
"status": "affected",
"version": "01.00"
}
]
},
{
"modules": [
"Enhanced Wi-Fi Pairing"
],
"product": "Mini SE",
"vendor": "DJI",
"versions": [
{
"status": "affected",
"version": "01.00"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "byteme1001 (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "byteme1001 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in DJI Mavic Mini, Air, Spark and Mini SE up to 01.00.0500. Affected by this vulnerability is an unknown functionality of the component Enhanced Wi-Fi Pairing. The manipulation leads to authentication bypass by capture-replay. The attack must be carried out from within the local network. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.8,
"vectorString": "AV:A/AC:H/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T09:13:47.578Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-343674 | DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.343674"
},
{
"name": "VDB-343674 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.343674"
},
{
"name": "Submit #741323 | DJI DJI Mavic Mini, Spark, Mini SE 01.00.0500 and Below Authentication Bypass by Capture-replay",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.741323"
},
{
"tags": [
"related"
],
"url": "https://github.com/ByteMe1001/DJI-CatNect"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/ByteMe1001/DJI-CatNect/blob/main/exploit.c"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-02-01T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-02-02T08:28:17.000Z",
"value": "VulDB entry last update"
}
],
"title": "DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-1743",
"datePublished": "2026-02-02T04:02:07.053Z",
"dateReserved": "2026-02-01T16:35:47.330Z",
"dateUpdated": "2026-02-23T09:13:47.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-10250 (GCVE-0-2025-10250)
Vulnerability from nvd – Published: 2025-09-11 11:32 – Updated: 2025-09-11 14:35 Unsupported When Assigned
VLAI
EPSS
VEX
Title
DJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded key
Summary
A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Executing manipulation can lead to use of hard-coded cryptographic key
. The attacker needs to be present on the local network. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-11 13:28 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.323609 | vdb-entry |
| https://vuldb.com/?ctiid.323609 | signaturepermissions-required |
| https://vuldb.com/?submit.639757 | third-party-advisory |
| https://github.com/ByteMe1001/DJI-Enhanced-WiFi-W… | exploit |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Mavic Spark |
Affected:
01.00.0500
|
|
| DJI | Mavic Air |
Affected:
01.00.0500
|
|
| DJI | Mavic Mini |
Affected:
01.00.0500
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-10250",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-11T13:28:04.183322Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-11T14:35:20.945Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Telemetry Channel"
],
"product": "Mavic Spark",
"vendor": "DJI",
"versions": [
{
"status": "affected",
"version": "01.00.0500"
}
]
},
{
"modules": [
"Telemetry Channel"
],
"product": "Mavic Air",
"vendor": "DJI",
"versions": [
{
"status": "affected",
"version": "01.00.0500"
}
]
},
{
"modules": [
"Telemetry Channel"
],
"product": "Mavic Mini",
"vendor": "DJI",
"versions": [
{
"status": "affected",
"version": "01.00.0500"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "byteme1001 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Executing manipulation can lead to use of hard-coded cryptographic key\r . The attacker needs to be present on the local network. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500 entdeckt. Davon betroffen ist unbekannter Code der Komponente Telemetry Channel. Die Bearbeitung verursacht use of hard-coded cryptographic key\r . Der Angriff erfordert Zugriff auf das lokale Netzwerk. Ein Angriff erfordert eine vergleichsweise hohe Komplexit\u00e4t. Sie gilt als schwierig ausnutzbar. Die Ausnutzung wurde ver\u00f6ffentlicht und kann verwendet werden."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:A/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-320",
"description": "Key Management Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-11T11:32:06.456Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-323609 | DJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded key",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.323609"
},
{
"name": "VDB-323609 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.323609"
},
{
"name": "Submit #639757 | DJI DJI Mavic Mini 01.00.0500 Cryptographic Issues",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.639757"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/ByteMe1001/DJI-Enhanced-WiFi-Weak-Cryptography"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2025-09-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-09-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-09-11T07:19:25.000Z",
"value": "VulDB entry last update"
}
],
"title": "DJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded key"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-10250",
"datePublished": "2025-09-11T11:32:06.456Z",
"dateReserved": "2025-09-11T05:12:36.364Z",
"dateUpdated": "2025-09-11T14:35:20.945Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-6951 (GCVE-0-2023-6951)
Vulnerability from nvd – Published: 2024-04-02 10:28 – Updated: 2024-09-30 10:04
VLAI
EPSS
VEX
Summary
A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone’s Wi- Fi network. This, in turn, allows the attacker to perform unauthorized interaction with the network services exposed by the drone and to potentially decrypt the Wi-Fi traffic exchanged between the drone and the Android/IOS device of the legitimate user during QuickTransfer mode. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-02 18:42 UTC
CWE
- CWE-334 - Small Space of Random Values
Assigner
References
1 reference
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Mavic 3 Pro |
Affected:
0 , < 01.01.0300
(custom)
|
|
| DJI | Mavic 3 |
Affected:
0 , < 01.00.1200
(custom)
|
|
| DJI | Mavic 3 Classic |
Affected:
0 , < 01.00.0500
(custom)
|
|
| DJI | Mavic 3 Enterprise |
Affected:
0 , < 7.01.10.03
(custom)
|
|
| DJI | Matrice 300 |
Affected:
0 , < 57.00.01.00
(custom)
|
|
| DJI | Matrice M30 |
Affected:
0 , < 07.01.0022
(custom)
|
|
| DJI | Mini 3 Pro |
Affected:
0 , < 01.00.0620
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-6951",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-02T18:42:46.556534Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:17:06.038Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:42:08.525Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6951/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThan": "01.01.0300",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3",
"vendor": "DJI",
"versions": [
{
"lessThan": "01.00.1200",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Classic",
"vendor": "DJI",
"versions": [
{
"lessThan": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Enterprise",
"vendor": "DJI",
"versions": [
{
"lessThan": "7.01.10.03",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Matrice 300",
"vendor": "DJI",
"versions": [
{
"lessThan": "57.00.01.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Matrice M30",
"vendor": "DJI",
"versions": [
{
"lessThan": "07.01.0022",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThan": "01.00.0620",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Nicolo\u0027 Facchi of Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone\u2019s Wi- Fi network. This, in turn, allows the attacker to perform unauthorized interaction with the network services exposed by the drone and to potentially decrypt the Wi-Fi traffic exchanged between the drone and the Android/IOS device of the legitimate user during QuickTransfer mode. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620."
}
],
"value": "A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone\u2019s Wi- Fi network. This, in turn, allows the attacker to perform unauthorized interaction with the network services exposed by the drone and to potentially decrypt the Wi-Fi traffic exchanged between the drone and the Android/IOS device of the legitimate user during QuickTransfer mode. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-334",
"description": "CWE-334: Small Space of Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-30T10:04:13.991Z",
"orgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c",
"shortName": "Nozomi"
},
"references": [
{
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6951/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c",
"assignerShortName": "Nozomi",
"cveId": "CVE-2023-6951",
"datePublished": "2024-04-02T10:28:05.544Z",
"dateReserved": "2023-12-19T15:38:36.729Z",
"dateUpdated": "2024-09-30T10:04:13.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-114357 (GCVE-0-2026-114357)
Vulnerability from cvelistv5 – Published: 2026-10-23 13:39 – Updated: 2026-10-23 13:39
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)
Summary
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).
Severity
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or \u0027setprop persist.adb.tcp.port 5555\u0027), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).\u003c/p\u003e"
}
],
"value": "Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or \u0027setprop persist.adb.tcp.port 5555\u0027), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3)."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Unauthenticated shell over USB by default (and over the network if ADB-over-TCP is enabled); foothold for escalation to root."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "ADB-over-TCP enabled (non-default): network-reachable"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:39:28.510Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114357",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114357"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114357",
"datePublished": "2026-10-23T13:39:28.510Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:39:28.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114356 (GCVE-0-2026-114356)
Vulnerability from cvelistv5 – Published: 2026-10-23 13:37 – Updated: 2026-10-23 13:37
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
Summary
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authorization in the system-privileged \u0027DJIUpdateService\u0027 binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.\u003c/p\u003e"
}
],
"value": "Missing authorization in the system-privileged \u0027DJIUpdateService\u0027 binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Local zero-permission application triggers destructive privileged operations (factory reset/wipe, shutdown) and the firmware-apply hand-off."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:37:34.059Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114356",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114356"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114356",
"datePublished": "2026-10-23T13:37:34.059Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:37:34.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114355 (GCVE-0-2026-114355)
Vulnerability from cvelistv5 – Published: 2026-10-23 13:35 – Updated: 2026-10-23 13:35
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root
Summary
OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.
Severity
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOS command injection in the root-privileged \u0027hardware_monitor\u0027 helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.\u003c/p\u003e"
}
],
"value": "OS command injection in the root-privileged \u0027hardware_monitor\u0027 helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Local unprivileged process escalates to root via attacker-controlled log content."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:35:42.796Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114355",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114355"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114355",
"datePublished": "2026-10-23T13:35:42.796Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:35:42.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114354 (GCVE-0-2026-114354)
Vulnerability from cvelistv5 – Published: 2026-10-23 13:33 – Updated: 2026-10-23 13:33
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
Summary
Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authorization in the native binder service \u0027android.dji.server\u0027 (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged \u0027assistant\u0027 daemon without any caller-identity or permission check.\u003c/p\u003e"
}
],
"value": "Missing authorization in the native binder service \u0027android.dji.server\u0027 (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged \u0027assistant\u0027 daemon without any caller-identity or permission check."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Local zero-permission application gains arbitrary command execution as root."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:33:36.131Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114354",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114354"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114354",
"datePublished": "2026-10-23T13:33:36.131Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:33:36.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114353 (GCVE-0-2026-114353)
Vulnerability from cvelistv5 – Published: 2026-10-23 13:31 – Updated: 2026-10-23 13:31
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution
Summary
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().
Severity
CWE
- CWE-912 - Hidden Functionality
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eHidden functionality (undocumented backdoor) in the root-privileged \u0027assistant\u0027 daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string \u0027dji26656677\u0027 to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().\u003c/p\u003e"
}
],
"value": "Hidden functionality (undocumented backdoor) in the root-privileged \u0027assistant\u0027 daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string \u0027dji26656677\u0027 to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system()."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Unauthenticated root-level command execution over the USB serial interface."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:31:05.598Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114353",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114353"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114353",
"datePublished": "2026-10-23T13:31:05.598Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:31:05.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78321 (GCVE-0-2026-78321)
Vulnerability from cvelistv5 – Published: 2026-08-24 08:47 – Updated: 2026-08-24 12:51
VLAI
EPSS
VEX
Title
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
Summary
The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling legitimate requests and causing a denial of service that prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 12:31 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.dji.com/help/content?customId=en-… | product |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Neo |
Affected:
0 , ≤ 01.00.0400,
(semver)
|
|
| DJI | Neo 2 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Flip |
Affected:
0 , ≤ 01.00.1200
(semver)
|
|
| DJI | Air 3 |
Affected:
0 , ≤ 01.00.1600
(semver)
|
|
| DJI | Air 3S |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Avata 2 |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Avata 360 |
Affected:
0 , ≤ 01.00.0300
(semver)
|
|
| DJI | Mavic 3 |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Mavic 3 Classic |
Affected:
0 , ≤ 01.00.0800
(semver)
|
|
| DJI | Mavic 3 Pro |
Affected:
0 , ≤ 01.01.0700
(semver)
|
|
| DJI | Mavic 4 Pro |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 2 |
Affected:
0 , ≤ 01.07.0200,
(semver)
|
|
| DJI | Mini 3 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 3 Pro |
Affected:
0 , ≤ 01.00.0900
(semver)
|
|
| DJI | Mini 4 Pro |
Affected:
0 , ≤ 01.00.1100
(semver)
|
|
| DJI | Mini 5 Pro |
Affected:
0 , ≤ 01.00.0600
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78321",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T12:31:40.529460Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T12:51:11.340Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Neo",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400,",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neo 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Flip",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3S",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 360",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0300",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Classic",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0800",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.01.0700",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.07.0200,",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0900",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1100",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 5 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdelrahman Yousef"
},
{
"lang": "en",
"type": "finder",
"value": "Dr. Jordan Samhi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone\u0027s internal network can exhaust the server\u0027s connection pool by repeatedly requesting a stored media file, preventing the server from handling legitimate requests and causing a denial of service that prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode.\u003cbr\u003e\u003cbr\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003cbr\u003e\u003cbr\u003eRemediation requires a firmware update from the vendor.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone\u0027s internal network can exhaust the server\u0027s connection pool by repeatedly requesting a stored media file, preventing the server from handling legitimate requests and causing a denial of service that prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\nRemediation requires a firmware update from the vendor."
}
],
"impacts": [
{
"capecId": "CAPEC-469",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-469 HTTP DoS"
}
]
},
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125 Flooding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T08:47:11.796Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"product"
],
"url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-78321",
"datePublished": "2026-08-24T08:47:11.796Z",
"dateReserved": "2026-08-24T08:46:02.862Z",
"dateUpdated": "2026-08-24T12:51:11.340Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78306 (GCVE-0-2026-78306)
Vulnerability from cvelistv5 – Published: 2026-08-24 08:08 – Updated: 2026-10-12 12:09
VLAI
EPSS
VEX
Title
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
Summary
DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone's internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator's wireless control, video, and telemetry connections during flight.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 12:31 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://support.dji.com/help/content?customId=en-… | product |
| https://github.com/Wh02m1/CVE-2026-78306 | technical-description |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Neo |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Neo 2 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Flip |
Affected:
0 , ≤ 01.00.1200
(semver)
|
|
| DJI | Air 3 |
Affected:
0 , ≤ 01.00.1600
(semver)
|
|
| DJI | Air 3S |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Avata 2 |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Avata 360 |
Affected:
0 , ≤ 01.00.0300
(semver)
|
|
| DJI | Mavic 3 |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Mavic 3 Classic |
Affected:
0 , ≤ 01.00.0800
(semver)
|
|
| DJI | Mavic 3 Pro |
Affected:
0 , ≤ 01.01.0700
(semver)
|
|
| DJI | Mavic 4 Pro |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 2 |
Affected:
0 , ≤ 01.07.0200
(semver)
|
|
| DJI | Mini 3 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 3 Pro |
Affected:
0 , ≤ 01.00.0900
(semver)
|
|
| DJI | Mini 4 Pro |
Affected:
0 , ≤ 01.00.1100
(semver)
|
|
| DJI | Mini 5 Pro |
Affected:
0 , ≤ 01.00.0600
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78306",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T12:31:53.968074Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T12:51:11.501Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Neo",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neo 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Flip",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3S",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 360",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0300",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Classic",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0800",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.01.0700",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.07.0200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0900",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1100",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 5 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdelrahman Yousef"
},
{
"lang": "en",
"type": "finder",
"value": "Dr. Jordan Samhi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone\u0027s internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator\u0027s wireless control, video, and telemetry connections during flight.\u003cbr\u003e\u003cbr\u003e\u003cdiv\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003c/div\u003e\u003cbr\u003eRemediation requires a firmware update from the vendor.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone\u0027s internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator\u0027s wireless control, video, and telemetry connections during flight.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\n\nRemediation requires a firmware update from the vendor."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T12:09:08.628Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"product"
],
"url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Wh02m1/CVE-2026-78306"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1-2026-20018"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-78306",
"datePublished": "2026-08-24T08:08:00.485Z",
"dateReserved": "2026-08-24T08:07:50.044Z",
"dateUpdated": "2026-10-12T12:09:08.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78255 (GCVE-0-2026-78255)
Vulnerability from cvelistv5 – Published: 2026-08-24 07:25 – Updated: 2026-08-24 16:32
VLAI
EPSS
VEX
Title
DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media
Summary
The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator's routines.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 16:31 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.dji.com/help/content?customId=en-… | product |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Neo |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Neo 2 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Flip |
Affected:
0 , ≤ 01.00.1200
(semver)
|
|
| DJI | Air 3 |
Affected:
0 , ≤ 01.00.1600,
(semver)
|
|
| DJI | Air 3S |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Avata 2 |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Avata 360 |
Affected:
0 , ≤ 01.00.0300
(semver)
|
|
| DJI | Mavic 3 |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Mavic 3 Classic |
Affected:
0 , ≤ 01.00.0800
(semver)
|
|
| DJI | Mavic 3 Pro |
Affected:
0 , ≤ 01.01.0700
(semver)
|
|
| DJI | Mavic 4 Pro |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 2 |
Affected:
0 , ≤ 01.07.0200
(semver)
|
|
| DJI | Mini 3 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 3 Pro |
Affected:
0 , ≤ 01.00.0900
(semver)
|
|
| DJI | Mini 4 Pro |
Affected:
0 , ≤ 01.00.1100
(semver)
|
|
| DJI | Mini 5 Pro |
Affected:
0 , ≤ 01.00.0600
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78255",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T16:31:56.561456Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T16:32:27.348Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Neo",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neo 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Flip",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1600,",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3S",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 360",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0300",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Classic",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0800",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.01.0700",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.07.0200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0900",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1100",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 5 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdelrahman Yousef"
},
{
"lang": "en",
"type": "finder",
"value": "Dr. Jordan Samhi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone\u0027s internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator\u0027s routines.\u003cbr\u003e\u003cbr\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone\u0027s internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator\u0027s routines.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600."
}
],
"impacts": [
{
"capecId": "CAPEC-87",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-87 Forceful Browsing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T07:25:24.159Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"product"
],
"url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-78255",
"datePublished": "2026-08-24T07:25:24.159Z",
"dateReserved": "2026-08-24T07:25:18.359Z",
"dateUpdated": "2026-08-24T16:32:27.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78251 (GCVE-0-2026-78251)
Vulnerability from cvelistv5 – Published: 2026-08-24 07:04 – Updated: 2026-08-27 16:23
VLAI
EPSS
VEX
Title
DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory
Summary
DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An attacker with access to the drone's internal network or USB RNDIS interface can exhaust the available storage, preventing the aircraft from writing flight records, logs, and telemetry and potentially preventing subsequent firmware updates. Uploaded files persist across reboot and factory reset.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 16:53 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.dji.com/help/content?customId=en-… | product |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Neo |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Neo 2 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Flip |
Affected:
0 , ≤ 01.00.1200
(semver)
|
|
| DJI | Air 3 |
Affected:
0 , ≤ 01.00.1600
(semver)
|
|
| DJI | Air 3S |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Avata 2 |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Avata 360 |
Affected:
0 , ≤ 01.00.0300
(semver)
|
|
| DJI | Mavic 3 |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Mavic 3 Classic |
Affected:
0 , ≤ 01.00.0800
(semver)
|
|
| DJI | Mavic 3 Pro |
Affected:
0 , ≤ 01.01.0700
(semver)
|
|
| DJI | Mavic 4 Pro |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 2 |
Affected:
0 , ≤ 01.07.0200
(semver)
|
|
| DJI | Mini 3 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 3 Pro |
Affected:
0 , ≤ 01.00.0900
(semver)
|
|
| DJI | Mini 4 Pro |
Affected:
0 , ≤ 01.00.1100
(semver)
|
|
| DJI | Mini 5 Pro |
Affected:
0 , ≤ 01.00.0600
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78251",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T16:53:34.972831Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T16:53:46.387Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Neo",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neo 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Flip",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3S",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 360",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0300",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Classic",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0800",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.01.0700",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.07.0200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0900",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1100",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 5 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdelrahman Yousef"
},
{
"lang": "en",
"type": "finder",
"value": "Dr. Jordan Samhi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An attacker with access to the drone\u0027s internal network or USB RNDIS interface can exhaust the available storage, preventing the aircraft from writing flight records, logs, and telemetry and potentially preventing subsequent firmware updates. Uploaded files persist across reboot and factory reset.\u003cbr\u003e\u003cbr\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003cbr\u003e\u003cbr\u003eRemediation requires a firmware update from the vendor.\u0026nbsp;\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An attacker with access to the drone\u0027s internal network or USB RNDIS interface can exhaust the available storage, preventing the aircraft from writing flight records, logs, and telemetry and potentially preventing subsequent firmware updates. Uploaded files persist across reboot and factory reset.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\nRemediation requires a firmware update from the vendor."
}
],
"impacts": [
{
"capecId": "CAPEC-560",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-560 Use of Known Domain Credentials"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T16:23:12.462Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"product"
],
"url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-78251",
"datePublished": "2026-08-24T07:04:32.474Z",
"dateReserved": "2026-08-24T07:02:39.767Z",
"dateUpdated": "2026-08-27T16:23:12.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77812 (GCVE-0-2026-77812)
Vulnerability from cvelistv5 – Published: 2026-08-21 14:06 – Updated: 2026-10-12 12:14
VLAI
EPSS
VEX
Title
Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE
Summary
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.
* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network
* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.
* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely
* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed
* A BLE sniffer and presence during one normal DJI Fly connection are needed
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 17:42 UTC
CWE
- CWE-311 - Missing Encryption of Sensitive Data
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://support.dji.com/help/content?customId=en-… | technical-description |
| https://github.com/Wh02m1/CVE-2026-77812 | technical-description |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Neo |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Neo 2 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | DJI Flip |
Affected:
0 , ≤ 01.00.1200
(semver)
|
|
| DJI | Air 3 |
Affected:
0 , ≤ 01.00.1600
(semver)
|
|
| DJI | Air 3S |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Avata 2 |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Avata 360 |
Affected:
0 , ≤ 01.00.0300
(semver)
|
|
| DJI | Mavic 3 |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Mavic 3 Classic |
Affected:
0 , ≤ 01.00.0800
(semver)
|
|
| DJI | Mavic 3 Pro |
Affected:
0 , ≤ 01.01.0700
(semver)
|
|
| DJI | Mavic 4 Pro |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 2 |
Affected:
0 , ≤ 01.07.0200
(semver)
|
|
| DJI | Mini 3 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 3 Pro |
Affected:
0 , ≤ 01.00.0900
(semver)
|
|
| DJI | Mini 4 Pro |
Affected:
0 , ≤ 01.00.1100
(semver)
|
|
| DJI | Mini 5 Pro |
Affected:
0 , ≤ 01.00.0600
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77812",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T17:42:02.404909Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T17:42:36.191Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Neo",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neo 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DJI Flip",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3S",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 360",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0300",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Classic",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0800",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.01.0700",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.07.0200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0900",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1100",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 5 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdelrahman Yousef"
},
{
"lang": "en",
"type": "finder",
"value": "Dr. Jordan Samhi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone\u0027s Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone\u0027s internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.\u003cbr\u003e\u003cbr\u003e* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone\u0027s network \u003cbr\u003e* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.\u003cbr\u003e* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely\u003cbr\u003e* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed\u003cbr\u003e* A BLE sniffer and presence during one normal DJI Fly connection are needed\u003cbr\u003e\u003cbr\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003cbr\u003e\u003cbr\u003eRemediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading."
}
],
"value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone\u0027s Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone\u0027s internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.\n\n* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone\u0027s network \n* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.\n* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely\n* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed\n* A BLE sniffer and presence during one normal DJI Fly connection are needed\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\nRemediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-311",
"description": "CWE-311 Missing Encryption of Sensitive Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T12:14:20.097Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Wh02m1/CVE-2026-77812"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1-2026-20157"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-77812",
"datePublished": "2026-08-21T14:06:55.723Z",
"dateReserved": "2026-08-21T14:06:52.579Z",
"dateUpdated": "2026-10-12T12:14:20.097Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1743 (GCVE-0-2026-1743)
Vulnerability from cvelistv5 – Published: 2026-02-02 04:02 – Updated: 2026-02-23 09:13
VLAI
EPSS
VEX
Title
DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay
Summary
A vulnerability has been found in DJI Mavic Mini, Air, Spark and Mini SE up to 01.00.0500. Affected by this vulnerability is an unknown functionality of the component Enhanced Wi-Fi Pairing. The manipulation leads to authentication bypass by capture-replay. The attack must be carried out from within the local network. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-03 14:32 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.343674 | vdb-entry |
| https://vuldb.com/?ctiid.343674 | signaturepermissions-required |
| https://vuldb.com/?submit.741323 | third-party-advisory |
| https://github.com/ByteMe1001/DJI-CatNect | related |
| https://github.com/ByteMe1001/DJI-CatNect/blob/ma… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1743",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T14:32:25.302924Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T15:32:46.738Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Enhanced Wi-Fi Pairing"
],
"product": "Mavic Mini",
"vendor": "DJI",
"versions": [
{
"status": "affected",
"version": "01.00"
}
]
},
{
"modules": [
"Enhanced Wi-Fi Pairing"
],
"product": "Air",
"vendor": "DJI",
"versions": [
{
"status": "affected",
"version": "01.00"
}
]
},
{
"modules": [
"Enhanced Wi-Fi Pairing"
],
"product": "Spark",
"vendor": "DJI",
"versions": [
{
"status": "affected",
"version": "01.00"
}
]
},
{
"modules": [
"Enhanced Wi-Fi Pairing"
],
"product": "Mini SE",
"vendor": "DJI",
"versions": [
{
"status": "affected",
"version": "01.00"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "byteme1001 (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "byteme1001 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in DJI Mavic Mini, Air, Spark and Mini SE up to 01.00.0500. Affected by this vulnerability is an unknown functionality of the component Enhanced Wi-Fi Pairing. The manipulation leads to authentication bypass by capture-replay. The attack must be carried out from within the local network. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.8,
"vectorString": "AV:A/AC:H/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T09:13:47.578Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-343674 | DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.343674"
},
{
"name": "VDB-343674 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.343674"
},
{
"name": "Submit #741323 | DJI DJI Mavic Mini, Spark, Mini SE 01.00.0500 and Below Authentication Bypass by Capture-replay",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.741323"
},
{
"tags": [
"related"
],
"url": "https://github.com/ByteMe1001/DJI-CatNect"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/ByteMe1001/DJI-CatNect/blob/main/exploit.c"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-02-01T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-02-02T08:28:17.000Z",
"value": "VulDB entry last update"
}
],
"title": "DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-1743",
"datePublished": "2026-02-02T04:02:07.053Z",
"dateReserved": "2026-02-01T16:35:47.330Z",
"dateUpdated": "2026-02-23T09:13:47.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-10250 (GCVE-0-2025-10250)
Vulnerability from cvelistv5 – Published: 2025-09-11 11:32 – Updated: 2025-09-11 14:35 Unsupported When Assigned
VLAI
EPSS
VEX
Title
DJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded key
Summary
A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Executing manipulation can lead to use of hard-coded cryptographic key
. The attacker needs to be present on the local network. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-11 13:28 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.323609 | vdb-entry |
| https://vuldb.com/?ctiid.323609 | signaturepermissions-required |
| https://vuldb.com/?submit.639757 | third-party-advisory |
| https://github.com/ByteMe1001/DJI-Enhanced-WiFi-W… | exploit |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Mavic Spark |
Affected:
01.00.0500
|
|
| DJI | Mavic Air |
Affected:
01.00.0500
|
|
| DJI | Mavic Mini |
Affected:
01.00.0500
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-10250",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-11T13:28:04.183322Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-11T14:35:20.945Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Telemetry Channel"
],
"product": "Mavic Spark",
"vendor": "DJI",
"versions": [
{
"status": "affected",
"version": "01.00.0500"
}
]
},
{
"modules": [
"Telemetry Channel"
],
"product": "Mavic Air",
"vendor": "DJI",
"versions": [
{
"status": "affected",
"version": "01.00.0500"
}
]
},
{
"modules": [
"Telemetry Channel"
],
"product": "Mavic Mini",
"vendor": "DJI",
"versions": [
{
"status": "affected",
"version": "01.00.0500"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "byteme1001 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Executing manipulation can lead to use of hard-coded cryptographic key\r . The attacker needs to be present on the local network. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500 entdeckt. Davon betroffen ist unbekannter Code der Komponente Telemetry Channel. Die Bearbeitung verursacht use of hard-coded cryptographic key\r . Der Angriff erfordert Zugriff auf das lokale Netzwerk. Ein Angriff erfordert eine vergleichsweise hohe Komplexit\u00e4t. Sie gilt als schwierig ausnutzbar. Die Ausnutzung wurde ver\u00f6ffentlicht und kann verwendet werden."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:A/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-320",
"description": "Key Management Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-11T11:32:06.456Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-323609 | DJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded key",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.323609"
},
{
"name": "VDB-323609 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.323609"
},
{
"name": "Submit #639757 | DJI DJI Mavic Mini 01.00.0500 Cryptographic Issues",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.639757"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/ByteMe1001/DJI-Enhanced-WiFi-Weak-Cryptography"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2025-09-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-09-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-09-11T07:19:25.000Z",
"value": "VulDB entry last update"
}
],
"title": "DJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded key"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-10250",
"datePublished": "2025-09-11T11:32:06.456Z",
"dateReserved": "2025-09-11T05:12:36.364Z",
"dateUpdated": "2025-09-11T14:35:20.945Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GCVE-1-2026-20096 (CVE-2026-78321)
Vulnerability from gna-1 – Published: 2026-08-24 08:45 – Updated: 2026-08-24 08:46
VLAI
EPSS
VEX
Title
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
Summary
The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling legitimate requests and causing a denial of service that prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor.
Severity
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
References
1 reference
| URL | Tags |
|---|---|
| https://support.dji.com/help/content?customId=en-… | product |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Neo |
Affected:
0 , ≤ 01.00.0400,
(semver)
|
|
| DJI | Neo 2 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Flip |
Affected:
0 , ≤ 01.00.1200
(semver)
|
|
| DJI | Air 3 |
Affected:
0 , ≤ 01.00.1600
(semver)
|
|
| DJI | Air 3S |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Avata 2 |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Avata 360 |
Affected:
0 , ≤ 01.00.0300
(semver)
|
|
| DJI | Mavic 3 |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Mavic 3 Classic |
Affected:
0 , ≤ 01.00.0800
(semver)
|
|
| DJI | Mavic 3 Pro |
Affected:
0 , ≤ 01.01.0700
(semver)
|
|
| DJI | Mavic 4 Pro |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 2 |
Affected:
0 , ≤ 01.07.0200,
(semver)
|
|
| DJI | Mini 3 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 3 Pro |
Affected:
0 , ≤ 01.00.0900
(semver)
|
|
| DJI | Mini 4 Pro |
Affected:
0 , ≤ 01.00.1100
(semver)
|
|
| DJI | Mini 5 Pro |
Affected:
0 , ≤ 01.00.0600
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Neo",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400,",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neo 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Flip",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3S",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 360",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0300",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Classic",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0800",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.01.0700",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.07.0200,",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0900",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1100",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 5 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdelrahman Yousef"
},
{
"lang": "en",
"type": "finder",
"value": "Dr. Jordan Samhi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone\u0027s internal network can exhaust the server\u0027s connection pool by repeatedly requesting a stored media file, preventing the server from handling legitimate requests and causing a denial of service that prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode.\u003cbr\u003e\u003cbr\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003cbr\u003e\u003cbr\u003eRemediation requires a firmware update from the vendor.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone\u0027s internal network can exhaust the server\u0027s connection pool by repeatedly requesting a stored media file, preventing the server from handling legitimate requests and causing a denial of service that prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\nRemediation requires a firmware update from the vendor."
}
],
"impacts": [
{
"capecId": "CAPEC-469",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-469 HTTP DoS"
}
]
},
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125 Flooding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"tags": [
"product"
],
"url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1-2026-20096"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-78321",
"datePublished": "2026-08-24T08:45:47.214204Z",
"dateReserved": "2026-08-24T08:46:02.862Z",
"dateUpdated": "2026-08-24T08:46:02.937720Z",
"requesterUserId": "00000000-0000-4000-9000-000000000000",
"serial": 1,
"state": "PUBLISHED",
"vulnId": "gcve-1-2026-20096"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GCVE-1-2026-20018 (CVE-2026-78306)
Vulnerability from gna-1 – Published: 2026-08-24 08:05 – Updated: 2026-10-12 12:08
VLAI
EPSS
VEX
Title
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
Summary
DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone's internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator's wireless control, video, and telemetry connections during flight.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor.
Severity
CWE
- CWE-306 - Missing Authentication for Critical Function
References
2 references
| URL | Tags |
|---|---|
| https://support.dji.com/help/content?customId=en-… | product |
| https://github.com/Wh02m1/CVE-2026-78306 | technical-description |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Neo |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Neo 2 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Flip |
Affected:
0 , ≤ 01.00.1200
(semver)
|
|
| DJI | Air 3 |
Affected:
0 , ≤ 01.00.1600
(semver)
|
|
| DJI | Air 3S |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Avata 2 |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Avata 360 |
Affected:
0 , ≤ 01.00.0300
(semver)
|
|
| DJI | Mavic 3 |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Mavic 3 Classic |
Affected:
0 , ≤ 01.00.0800
(semver)
|
|
| DJI | Mavic 3 Pro |
Affected:
0 , ≤ 01.01.0700
(semver)
|
|
| DJI | Mavic 4 Pro |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 2 |
Affected:
0 , ≤ 01.07.0200
(semver)
|
|
| DJI | Mini 3 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 3 Pro |
Affected:
0 , ≤ 01.00.0900
(semver)
|
|
| DJI | Mini 4 Pro |
Affected:
0 , ≤ 01.00.1100
(semver)
|
|
| DJI | Mini 5 Pro |
Affected:
0 , ≤ 01.00.0600
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Neo",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neo 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Flip",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3S",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 360",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0300",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Classic",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0800",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.01.0700",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.07.0200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0900",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1100",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 5 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdelrahman Yousef"
},
{
"lang": "en",
"type": "finder",
"value": "Dr. Jordan Samhi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone\u0027s internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator\u0027s wireless control, video, and telemetry connections during flight.\u003cbr\u003e\u003cbr\u003e\u003cdiv\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003c/div\u003e\u003cbr\u003eRemediation requires a firmware update from the vendor.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone\u0027s internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator\u0027s wireless control, video, and telemetry connections during flight.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\n\nRemediation requires a firmware update from the vendor."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"tags": [
"product"
],
"url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Wh02m1/CVE-2026-78306"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1-2026-20018"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-78306",
"datePublished": "2026-08-24T08:05:00.000Z",
"dateReserved": "2026-08-24T08:07:00.000Z",
"dateUpdated": "2026-10-12T12:08:34.359422Z",
"requesterUserId": "00000000-0000-4000-9000-000000000000",
"serial": 1,
"state": "PUBLISHED",
"vulnId": "gcve-1-2026-20018"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GCVE-1-2026-20169 (CVE-2026-78255)
Vulnerability from gna-1 – Published: 2026-08-24 07:23 – Updated: 2026-08-24 07:25
VLAI
EPSS
VEX
Title
DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media
Summary
The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator's routines.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Severity
CWE
- CWE-306 - Missing Authentication for Critical Function
References
1 reference
| URL | Tags |
|---|---|
| https://support.dji.com/help/content?customId=en-… | product |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Neo |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Neo 2 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Flip |
Affected:
0 , ≤ 01.00.1200
(semver)
|
|
| DJI | Air 3 |
Affected:
0 , ≤ 01.00.1600,
(semver)
|
|
| DJI | Air 3S |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Avata 2 |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Avata 360 |
Affected:
0 , ≤ 01.00.0300
(semver)
|
|
| DJI | Mavic 3 |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Mavic 3 Classic |
Affected:
0 , ≤ 01.00.0800
(semver)
|
|
| DJI | Mavic 3 Pro |
Affected:
0 , ≤ 01.01.0700
(semver)
|
|
| DJI | Mavic 4 Pro |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 2 |
Affected:
0 , ≤ 01.07.0200
(semver)
|
|
| DJI | Mini 3 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 3 Pro |
Affected:
0 , ≤ 01.00.0900
(semver)
|
|
| DJI | Mini 4 Pro |
Affected:
0 , ≤ 01.00.1100
(semver)
|
|
| DJI | Mini 5 Pro |
Affected:
0 , ≤ 01.00.0600
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Neo",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neo 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Flip",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1600,",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3S",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 360",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0300",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Classic",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0800",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.01.0700",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.07.0200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0900",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1100",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 5 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdelrahman Yousef"
},
{
"lang": "en",
"type": "finder",
"value": "Dr. Jordan Samhi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone\u0027s internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator\u0027s routines.\u003cbr\u003e\u003cbr\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone\u0027s internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator\u0027s routines.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600."
}
],
"impacts": [
{
"capecId": "CAPEC-87",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-87 Forceful Browsing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"tags": [
"product"
],
"url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1-2026-20169"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-78255",
"datePublished": "2026-08-24T07:23:00.946991Z",
"dateReserved": "2026-08-24T07:25:18.359Z",
"dateUpdated": "2026-08-24T07:25:18.426734Z",
"requesterUserId": "00000000-0000-4000-9000-000000000000",
"serial": 1,
"state": "PUBLISHED",
"vulnId": "gcve-1-2026-20169"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GCVE-1-2026-20042 (CVE-2026-78251)
Vulnerability from gna-1 – Published: 2026-08-24 07:01 – Updated: 2026-08-27 16:22
VLAI
EPSS
VEX
Title
DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory
Summary
DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An attacker with access to the drone's internal network or USB RNDIS interface can exhaust the available storage, preventing the aircraft from writing flight records, logs, and telemetry and potentially preventing subsequent firmware updates. Uploaded files persist across reboot and factory reset.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor.
Severity
CWE
- CWE-798 - Use of Hard-coded Credentials
References
1 reference
| URL | Tags |
|---|---|
| https://support.dji.com/help/content?customId=en-… | product |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Neo |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Neo 2 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Flip |
Affected:
0 , ≤ 01.00.1200
(semver)
|
|
| DJI | Air 3 |
Affected:
0 , ≤ 01.00.1600
(semver)
|
|
| DJI | Air 3S |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Avata 2 |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Avata 360 |
Affected:
0 , ≤ 01.00.0300
(semver)
|
|
| DJI | Mavic 3 |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Mavic 3 Classic |
Affected:
0 , ≤ 01.00.0800
(semver)
|
|
| DJI | Mavic 3 Pro |
Affected:
0 , ≤ 01.01.0700
(semver)
|
|
| DJI | Mavic 4 Pro |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 2 |
Affected:
0 , ≤ 01.07.0200
(semver)
|
|
| DJI | Mini 3 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 3 Pro |
Affected:
0 , ≤ 01.00.0900
(semver)
|
|
| DJI | Mini 4 Pro |
Affected:
0 , ≤ 01.00.1100
(semver)
|
|
| DJI | Mini 5 Pro |
Affected:
0 , ≤ 01.00.0600
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Neo",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neo 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Flip",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3S",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 360",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0300",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Classic",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0800",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.01.0700",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.07.0200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0900",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1100",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 5 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdelrahman Yousef"
},
{
"lang": "en",
"type": "finder",
"value": "Dr. Jordan Samhi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An attacker with access to the drone\u0027s internal network or USB RNDIS interface can exhaust the available storage, preventing the aircraft from writing flight records, logs, and telemetry and potentially preventing subsequent firmware updates. Uploaded files persist across reboot and factory reset.\u003cbr\u003e\u003cbr\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003cbr\u003e\u003cbr\u003eRemediation requires a firmware update from the vendor.\u0026nbsp;\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An attacker with access to the drone\u0027s internal network or USB RNDIS interface can exhaust the available storage, preventing the aircraft from writing flight records, logs, and telemetry and potentially preventing subsequent firmware updates. Uploaded files persist across reboot and factory reset.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\nRemediation requires a firmware update from the vendor."
}
],
"impacts": [
{
"capecId": "CAPEC-560",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-560 Use of Known Domain Credentials"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"tags": [
"product"
],
"url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1-2026-20042"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-78251",
"datePublished": "2026-08-24T07:01:00.000Z",
"dateReserved": "2026-08-24T07:02:00.000Z",
"dateUpdated": "2026-08-27T16:22:40.055465Z",
"requesterUserId": "00000000-0000-4000-9000-000000000000",
"serial": 1,
"state": "PUBLISHED",
"vulnId": "gcve-1-2026-20042"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GCVE-1-2026-20157 (CVE-2026-77812)
Vulnerability from gna-1 – Published: 2026-08-21 14:06 – Updated: 2026-10-12 12:13
VLAI
EPSS
VEX
Title
Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE
Summary
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.
* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network
* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.
* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely
* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed
* A BLE sniffer and presence during one normal DJI Fly connection are needed
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading.
Severity
CWE
- CWE-311 - Missing Encryption of Sensitive Data
References
2 references
| URL | Tags |
|---|---|
| https://support.dji.com/help/content?customId=en-… | technical-description |
| https://github.com/Wh02m1/CVE-2026-77812 | technical-description |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | Neo |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Neo 2 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | DJI Flip |
Affected:
0 , ≤ 01.00.1200
(semver)
|
|
| DJI | Air 3 |
Affected:
0 , ≤ 01.00.1600
(semver)
|
|
| DJI | Air 3S |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Avata 2 |
Affected:
0 , ≤ 01.00.0400
(semver)
|
|
| DJI | Avata 360 |
Affected:
0 , ≤ 01.00.0300
(semver)
|
|
| DJI | Mavic 3 |
Affected:
0 , ≤ 01.00.1400
(semver)
|
|
| DJI | Mavic 3 Classic |
Affected:
0 , ≤ 01.00.0800
(semver)
|
|
| DJI | Mavic 3 Pro |
Affected:
0 , ≤ 01.01.0700
(semver)
|
|
| DJI | Mavic 4 Pro |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 2 |
Affected:
0 , ≤ 01.07.0200
(semver)
|
|
| DJI | Mini 3 |
Affected:
0 , ≤ 01.00.0500
(semver)
|
|
| DJI | Mini 3 Pro |
Affected:
0 , ≤ 01.00.0900
(semver)
|
|
| DJI | Mini 4 Pro |
Affected:
0 , ≤ 01.00.1100
(semver)
|
|
| DJI | Mini 5 Pro |
Affected:
0 , ≤ 01.00.0600
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Neo",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neo 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DJI Flip",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Air 3S",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Avata 360",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0300",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1400",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Classic",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0800",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.01.0700",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mavic 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 2",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.07.0200",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0500",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 3 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0900",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 4 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.1100",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mini 5 Pro",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "01.00.0600",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdelrahman Yousef"
},
{
"lang": "en",
"type": "finder",
"value": "Dr. Jordan Samhi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone\u0027s Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone\u0027s internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.\u003cbr\u003e\u003cbr\u003e* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone\u0027s network \u003cbr\u003e* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.\u003cbr\u003e* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely\u003cbr\u003e* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed\u003cbr\u003e* A BLE sniffer and presence during one normal DJI Fly connection are needed\u003cbr\u003e\u003cbr\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003cbr\u003e\u003cbr\u003eRemediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading."
}
],
"value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone\u0027s Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone\u0027s internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.\n\n* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone\u0027s network \n* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.\n* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely\n* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed\n* A BLE sniffer and presence during one normal DJI Fly connection are needed\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\nRemediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-311",
"description": "CWE-311 Missing Encryption of Sensitive Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Wh02m1/CVE-2026-77812"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1-2026-20157"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-77812",
"datePublished": "2026-08-21T14:06:00.000Z",
"dateReserved": "2026-08-21T14:06:00.000Z",
"dateUpdated": "2026-10-12T12:13:40.081904Z",
"requesterUserId": "00000000-0000-4000-9000-000000000000",
"serial": 1,
"state": "PUBLISHED",
"vulnId": "gcve-1-2026-20157"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}