Bluetooth Low Energy Vulnerability in DJI Drones Exposes Wi-Fi Credentials

CVE-2026-77812

What is CVE-2026-77812?

Certain DJI drones utilize Bluetooth Low Energy to transmit crucial Wi-Fi credentials in unencrypted DUML messages during communication with the DJI Fly application. An adversary within BLE proximity can intercept this traffic, thereby gaining access to the credentials in plaintext, including the Wi-Fi PSK, SSID, and session UUID. This access permits the attacker to connect to the drone's internal network and exploit exposed network services, with the potential to observe and decrypt sensitive Wi-Fi communications. Since the credentials remain static unless manually reset by the user, an attack can remain valid indefinitely, requiring immediate firmware updates to mitigate this vulnerability effectively.

References