DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution

Summary

CVE	CVE-2026-78306
State	PUBLISHED
Assigner	CIRCL
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-08-24 09:16:47 UTC
Updated	2026-08-24 09:16:47 UTC
Description	DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone's internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator's wireless control, video, and telemetry connections during flight. Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600. Remediation requires a firmware update from the vendor.

Risk And Classification

Primary CVSS: v4.0 8.5 HIGH from 5a6e4751-2f3f-4070-9419-94fb35b644e8

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Problem Types: CWE-306 | CWE-306 CWE-306 Missing Authentication for Critical Function

Version	Source	Type	Score	Severity	Vector
4.0	5a6e4751-2f3f-4070-9419-94fb35b644e8	Secondary	8.5	HIGH	`CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/C...`
4.0	CNA	CVSS	8.5	HIGH	`CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H`

CVSS v4.0 Breakdown

Attack Vector

Adjacent

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Confidentiality

None

Integrity

High

Availability

High

Sub Conf.

None

Sub Integrity

High

Sub Availability

High

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	DJI	Neo	affected 01.00.0400 semver	Not specified
CNA	DJI	Neo 2	affected 01.00.0500 semver	Not specified
CNA	DJI	Flip	affected 01.00.1200 semver	Not specified
CNA	DJI	Air 3	affected 01.00.1600 semver	Not specified
CNA	DJI	Air 3S	affected 01.00.1400 semver	Not specified
CNA	DJI	Avata 2	affected 01.00.0400 semver	Not specified
CNA	DJI	Avata 360	affected 01.00.0300 semver	Not specified
CNA	DJI	Mavic 3	affected 01.00.1400 semver	Not specified
CNA	DJI	Mavic 3 Classic	affected 01.00.0800 semver	Not specified
CNA	DJI	Mavic 3 Pro	affected 01.01.0700 semver	Not specified
CNA	DJI	Mavic 4 Pro	affected 01.00.0500 semver	Not specified
CNA	DJI	Mini 2	affected 01.07.0200 semver	Not specified
CNA	DJI	Mini 3	affected 01.00.0500 semver	Not specified
CNA	DJI	Mini 3 Pro	affected 01.00.0900 semver	Not specified
CNA	DJI	Mini 4 Pro	affected 01.00.1100 semver	Not specified
CNA	DJI	Mini 5 Pro	affected 01.00.0600 semver	Not specified

References

Reference	Source	Link	Tags
support.dji.com/help/content	5a6e4751-2f3f-4070-9419-94fb35b644e8	support.dji.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Abdelrahman Yousef (en)

CNA: Dr. Jordan Samhi (en)

There are currently no legacy QID mappings associated with this CVE.