CVE-2026-77812
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
DJI drones transmit DUML protocol messages over BLE without encryption. During Wi-Fi client connection or QuickTransfer mode, the DJI Fly app exchanges Wi-Fi credentials (PSK, SSID, UUID) over BLE. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext.
Risk Assessment
Obtained credentials allow the attacker to join the drone's internal Wi-Fi network, interact with exposed network services, and decrypt Wi-Fi traffic between the drone and the legitimate user. The captured UUID can be replayed to bypass physical confirmation of new devices, and credentials remain valid indefinitely unless the operator resets Wi-Fi settings.
Recommendation
Immediately update the drone firmware to a patched version provided by the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading.
Other vulnerabilities in DJI drones
See all- CVE-2026-78251Critical
DJI drones contain an FTP service with hardcoded credentials shared across affected models, allowing authenticated users to upload files without limits and overwrite files in **/blackbox/upgrade/**. An attacker with network or USB RNDIS access can exhaust storage, preventing flight records and firmware updates. Uploaded files persist across reboot and factory reset.
- CVE-2026-78321Medium
The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling legitimate requests and causing a denial of service that prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode. Remediation requires a firmware update from the vendor.
- CVE-2026-78306High
DJI drones expose an unauthenticated DUML command interface over Bluetooth, allowing an attacker within range to modify Wi-Fi parameters, including SSID, PSK, MAC address, country code, and channel. This can lead to drone control takeover or DoS.
- CVE-2026-78255High
The HTTP media server on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator's routines.
Original NVD description (English source)
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user. * An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network * The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices. * The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely * The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed * A BLE sniffer and presence during one normal DJI Fly connection are needed Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600. Remediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS