DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone's internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator's wireless control, video, and telemetry connections during flight. Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600. Remediation requires a firmware update from the vendor.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| DJI | Neo | up to 01.00.0400 | — | No fix listed | CNA |
| DJI | Neo 2 | up to 01.00.0500 | — | No fix listed | CNA |
| DJI | Flip | up to 01.00.1200 | — | No fix listed | CNA |
| DJI | Air 3 | up to 01.00.1600 | — | No fix listed | CNA |
| DJI | Air 3S | up to 01.00.1400 | — | No fix listed | CNA |
| DJI | Avata 2 | up to 01.00.0400 | — | No fix listed | CNA |
| DJI | Avata 360 | up to 01.00.0300 | — | No fix listed | CNA |
| DJI | Mavic 3 | up to 01.00.1400 | — | No fix listed | CNA |
| DJI | Mavic 3 Classic | up to 01.00.0800 | — | No fix listed | CNA |
| DJI | Mavic 3 Pro | up to 01.01.0700 | — | No fix listed | CNA |
| DJI | Mavic 4 Pro | up to 01.00.0500 | — | No fix listed | CNA |
| DJI | Mini 2 | up to 01.07.0200 | — | No fix listed | CNA |
| DJI | Mini 3 | up to 01.00.0500 | — | No fix listed | CNA |
| DJI | Mini 3 Pro | up to 01.00.0900 | — | No fix listed | CNA |
| DJI | Mini 4 Pro | up to 01.00.1100 | — | No fix listed | CNA |
| DJI | Mini 5 Pro | up to 01.00.0600 | — | No fix listed | CNA |
- Neo VendorDJI Affected up to 01.00.0400 Fixed in — No fix listed CNA
- Neo 2 VendorDJI Affected up to 01.00.0500 Fixed in — No fix listed CNA
- Flip VendorDJI Affected up to 01.00.1200 Fixed in — No fix listed CNA
- Air 3 VendorDJI Affected up to 01.00.1600 Fixed in — No fix listed CNA
- Air 3S VendorDJI Affected up to 01.00.1400 Fixed in — No fix listed CNA
- Avata 2 VendorDJI Affected up to 01.00.0400 Fixed in — No fix listed CNA
- Avata 360 VendorDJI Affected up to 01.00.0300 Fixed in — No fix listed CNA
- Mavic 3 VendorDJI Affected up to 01.00.1400 Fixed in — No fix listed CNA
- Mavic 3 Classic VendorDJI Affected up to 01.00.0800 Fixed in — No fix listed CNA
- Mavic 3 Pro VendorDJI Affected up to 01.01.0700 Fixed in — No fix listed CNA
- Mavic 4 Pro VendorDJI Affected up to 01.00.0500 Fixed in — No fix listed CNA
- Mini 2 VendorDJI Affected up to 01.07.0200 Fixed in — No fix listed CNA
- Mini 3 VendorDJI Affected up to 01.00.0500 Fixed in — No fix listed CNA
- Mini 3 Pro VendorDJI Affected up to 01.00.0900 Fixed in — No fix listed CNA
- Mini 4 Pro VendorDJI Affected up to 01.00.1100 Fixed in — No fix listed CNA
- Mini 5 Pro VendorDJI Affected up to 01.00.0600 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-78306
- 2026-10-03 Alias added: GHSA-vq46-xr65-w8q7
- 2026-10-12 1 new reference · CNA
References
More DJI vulnerabilities
- TI-2007-01042 Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted… CVSS 2.0HIGH 9.3
- TI-2026-54424 DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory CVSS 4.0CRITICAL 9.3
- TI-2026-54428 DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media CVSS 4.0HIGH 8.7
- TI-2026-79886 Missing authentication in DJI CrystalSky ZS600C ADB daemon CVSS 4.0CRITICAL 9.3
- TI-2026-79884 OS command injection in DJI CrystalSky ZS600C hardware_monitor CVSS 4.0HIGH 8.6
- TI-2026-54192 Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE CVSS 4.0CRITICAL 9.4
Sources
- CVE-2026-78306 · CVE Program
- CVE-2026-78306 · NVD
- FIRST EPSS
- GHSA-vq46-xr65-w8q7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences