CVE-2026-78306 (GCVE-0-2026-78306)

Vulnerability from cvelistv5 – Published: 2026-08-24 08:08 – Updated: 2026-10-12 12:09
VLAI
Title
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
Summary
DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone's internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator's wireless control, video, and telemetry connections during flight. Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600. Remediation requires a firmware update from the vendor.
Severity
8.5 (High)
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 12:31 UTC
CWE
  • CWE-306 - Missing Authentication for Critical Function
Assigner
CIRCL CNA under the ENISA root
CNA scorecard A 90/100 over 244 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
DJI Neo Affected: 0 , ≤ 01.00.0400 (semver)
guessed Create a notification for this product.
DJI Neo 2 Affected: 0 , ≤ 01.00.0500 (semver)
guessed Create a notification for this product.
DJI Flip Affected: 0 , ≤ 01.00.1200 (semver)
guessed Create a notification for this product.
DJI Air 3 Affected: 0 , ≤ 01.00.1600 (semver)
guessed Create a notification for this product.
DJI Air 3S Affected: 0 , ≤ 01.00.1400 (semver)
guessed Create a notification for this product.
DJI Avata 2 Affected: 0 , ≤ 01.00.0400 (semver)
guessed Create a notification for this product.
DJI Avata 360 Affected: 0 , ≤ 01.00.0300 (semver)
guessed Create a notification for this product.
DJI Mavic 3 Affected: 0 , ≤ 01.00.1400 (semver)
guessed Create a notification for this product.
DJI Mavic 3 Classic Affected: 0 , ≤ 01.00.0800 (semver)
guessed Create a notification for this product.
DJI Mavic 3 Pro Affected: 0 , ≤ 01.01.0700 (semver)
guessed Create a notification for this product.
DJI Mavic 4 Pro Affected: 0 , ≤ 01.00.0500 (semver)
guessed Create a notification for this product.
DJI Mini 2 Affected: 0 , ≤ 01.07.0200 (semver)
guessed Create a notification for this product.
DJI Mini 3 Affected: 0 , ≤ 01.00.0500 (semver)
guessed Create a notification for this product.
DJI Mini 3 Pro Affected: 0 , ≤ 01.00.0900 (semver)
guessed Create a notification for this product.
DJI Mini 4 Pro Affected: 0 , ≤ 01.00.1100 (semver)
guessed Create a notification for this product.
DJI Mini 5 Pro Affected: 0 , ≤ 01.00.0600 (semver)
guessed Create a notification for this product.
Credits
Abdelrahman Yousef Dr. Jordan Samhi
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-78306",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-24T12:31:53.968074Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-24T12:51:11.501Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Neo",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0400",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Neo 2",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0500",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Flip",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1200",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Air 3",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1600",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Air 3S",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1400",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Avata 2",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0400",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Avata 360",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0300",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mavic 3",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1400",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mavic 3 Classic",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0800",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mavic 3 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.01.0700",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mavic 4 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0500",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 2",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.07.0200",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 3",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0500",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 3 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0900",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 4 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1100",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 5 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0600",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abdelrahman Yousef"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Dr. Jordan Samhi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone\u0027s internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator\u0027s wireless control, video, and telemetry connections during flight.\u003cbr\u003e\u003cbr\u003e\u003cdiv\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003c/div\u003e\u003cbr\u003eRemediation requires a firmware update from the vendor.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone\u0027s internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator\u0027s wireless control, video, and telemetry connections during flight.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\n\nRemediation requires a firmware update from the vendor."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T12:09:08.628Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "tags": [
            "product"
          ],
          "url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/Wh02m1/CVE-2026-78306"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20018"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-78306",
    "datePublished": "2026-08-24T08:08:00.485Z",
    "dateReserved": "2026-08-24T08:07:50.044Z",
    "dateUpdated": "2026-10-12T12:09:08.628Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-78306",
      "date": "2026-10-23",
      "epss": "0.00238",
      "percentile": "0.1399"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Neo",
                "vendor": "DJI",
                "versions": [
                  {
                    "lessThanOrEqual": "01.00.0400",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Neo 2",
                "vendor": "DJI",
                "versions": [
                  {
                    "lessThanOrEqual": "01.00.0500",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Flip",
                "vendor": "DJI",
                "versions": [
                  {
                    "lessThanOrEqual": "01.00.1200",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Air 3",
                "vendor": "DJI",
                "versions": [
                  {
                    "lessThanOrEqual": "01.00.1600",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Air 3S",
                "vendor": "DJI",
                "versions": [
                  {
                    "lessThanOrEqual": "01.00.1400",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Avata 2",
                "vendor": "DJI",
                "versions": [
                  {
                    "lessThanOrEqual": "01.00.0400",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Avata 360",
                "vendor": "DJI",
                "versions": [
                  {
                    "lessThanOrEqual": "01.00.0300",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Mavic 3",
                "vendor": "DJI",
                "versions": [
                  {
                    "lessThanOrEqual": "01.00.1400",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Mavic 3 Classic",
                "vendor": "DJI",
                "versions": [
                  {
                    "lessThanOrEqual": "01.00.0800",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Mavic 3 Pro",
                "vendor": "DJI",
                "versions": [
                  {
                    "lessThanOrEqual": "01.01.0700",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Mavic 4 Pro",
                "vendor": "DJI",
                "versions": [
                  {
                    "lessThanOrEqual": "01.00.0500",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Mini 2",
                "vendor": "DJI",
                "versions": [
                  {
                    "lessThanOrEqual": "01.07.0200",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Mini 3",
                "vendor": "DJI",
                "versions": [
                  {
                    "lessThanOrEqual": "01.00.0500",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Mini 3 Pro",
                "vendor": "DJI",
                "versions": [
                  {
                    "lessThanOrEqual": "01.00.0900",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Mini 4 Pro",
                "vendor": "DJI",
                "versions": [
                  {
                    "lessThanOrEqual": "01.00.1100",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Mini 5 Pro",
                "vendor": "DJI",
                "versions": [
                  {
                    "lessThanOrEqual": "01.00.0600",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone\u0027s internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator\u0027s wireless control, video, and telemetry connections during flight.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\n\nRemediation requires a firmware update from the vendor."
          },
          {
            "lang": "es",
            "value": "Los drones DJI exponen una interfaz de comandos DUML no autenticada a trav\u00e9s de Bluetooth que permite a un atacante dentro del alcance de Bluetooth modificar los par\u00e1metros de configuraci\u00f3n de Wi-Fi, incluyendo el SSID, PSK, direcci\u00f3n MAC, c\u00f3digo de pa\u00eds regulatorio y canal inal\u00e1mbrico. Un atacante puede sobrescribir el PSK de Wi-Fi con un valor conocido y conectarse a la red Wi-Fi interna del drone, potencialmente obteniendo acceso a la interfaz de control de vuelo y emitiendo comandos de vuelo. comandos DUML elaborados tambi\u00e9n pueden deshabilitar o reiniciar las interfaces de Wi-Fi y Bluetooth, desconectar clientes de Wi-Fi o restablecer la configuraci\u00f3n inal\u00e1mbrica, lo que resulta en una condici\u00f3n de denegaci\u00f3n de servicio que puede interrumpir las conexiones inal\u00e1mbricas de control, video y telemetr\u00eda del operador durante el vuelo.\n\nLos modelos afectados son DJI Neo hasta 01.00.0400, DJI Neo 2 hasta 01.00.0500, DJI Flip hasta 01.00.1200, DJI Air 3 hasta 01.00.1600, DJI Air 3S hasta 01.00.1400, DJI Avata 2 hasta 01.00.0400, DJI Avata 360 hasta 01.00.0300, DJI Mavic 3 hasta 01.00.1400, DJI Mavic 3 Classic hasta 01.00.0800, DJI Mavic 3 Pro hasta 01.01.0700, DJI Mavic 4 Pro hasta 01.00.0500, DJI Mini 2 hasta 01.07.0200, DJI Mini 3 hasta 01.00.0500, DJI Mini 3 Pro hasta 01.00.0900, DJI Mini 4 Pro hasta 01.00.1100 y DJI Mini 5 Pro hasta 01.00.0600.\n\nLa remediaci\u00f3n requiere una actualizaci\u00f3n de firmware del proveedor."
          }
        ],
        "id": "CVE-2026-78306",
        "lastModified": "2026-10-14T13:10:00.187",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "ADJACENT",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-78306",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-24T12:31:53.968074Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-24T09:16:47.200",
        "references": [
          {
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "url": "https://github.com/Wh02m1/CVE-2026-78306"
          },
          {
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
          }
        ],
        "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-306"
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-78306",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-24T12:31:53.968074Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-24T12:50:42.464Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Neo",
              "vendor": "DJI",
              "versions": [
                {
                  "lessThanOrEqual": "01.00.0400",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Neo 2",
              "vendor": "DJI",
              "versions": [
                {
                  "lessThanOrEqual": "01.00.0500",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Flip",
              "vendor": "DJI",
              "versions": [
                {
                  "lessThanOrEqual": "01.00.1200",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Air 3",
              "vendor": "DJI",
              "versions": [
                {
                  "lessThanOrEqual": "01.00.1600",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Air 3S",
              "vendor": "DJI",
              "versions": [
                {
                  "lessThanOrEqual": "01.00.1400",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Avata 2",
              "vendor": "DJI",
              "versions": [
                {
                  "lessThanOrEqual": "01.00.0400",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Avata 360",
              "vendor": "DJI",
              "versions": [
                {
                  "lessThanOrEqual": "01.00.0300",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Mavic 3",
              "vendor": "DJI",
              "versions": [
                {
                  "lessThanOrEqual": "01.00.1400",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Mavic 3 Classic",
              "vendor": "DJI",
              "versions": [
                {
                  "lessThanOrEqual": "01.00.0800",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Mavic 3 Pro",
              "vendor": "DJI",
              "versions": [
                {
                  "lessThanOrEqual": "01.01.0700",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Mavic 4 Pro",
              "vendor": "DJI",
              "versions": [
                {
                  "lessThanOrEqual": "01.00.0500",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Mini 2",
              "vendor": "DJI",
              "versions": [
                {
                  "lessThanOrEqual": "01.07.0200",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Mini 3",
              "vendor": "DJI",
              "versions": [
                {
                  "lessThanOrEqual": "01.00.0500",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Mini 3 Pro",
              "vendor": "DJI",
              "versions": [
                {
                  "lessThanOrEqual": "01.00.0900",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Mini 4 Pro",
              "vendor": "DJI",
              "versions": [
                {
                  "lessThanOrEqual": "01.00.1100",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Mini 5 Pro",
              "vendor": "DJI",
              "versions": [
                {
                  "lessThanOrEqual": "01.00.0600",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Abdelrahman Yousef"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Dr. Jordan Samhi"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone\u0027s internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator\u0027s wireless control, video, and telemetry connections during flight.\u003cbr\u003e\u003cbr\u003e\u003cdiv\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003c/div\u003e\u003cbr\u003eRemediation requires a firmware update from the vendor.\u003cbr\u003e\u003cbr\u003e"
                }
              ],
              "value": "DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone\u0027s internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator\u0027s wireless control, video, and telemetry connections during flight.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\n\nRemediation requires a firmware update from the vendor."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-115",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-115 Authentication Bypass"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "ADJACENT",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-306",
                  "description": "CWE-306 Missing Authentication for Critical Function",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-12T12:09:08.628Z",
            "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "shortName": "CIRCL"
          },
          "references": [
            {
              "tags": [
                "product"
              ],
              "url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
            },
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://github.com/Wh02m1/CVE-2026-78306"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution",
          "x_gcve": [
            {
              "recordType": "advisory",
              "vulnId": "gcve-1-2026-20018"
            }
          ],
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "assignerShortName": "CIRCL",
        "cveId": "CVE-2026-78306",
        "datePublished": "2026-08-24T08:08:00.485Z",
        "dateReserved": "2026-08-24T08:07:50.044Z",
        "dateUpdated": "2026-10-12T12:09:08.628Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.