Bluetooth Vulnerability in DJI Drones Exposes Wi-Fi Settings
CVE-2026-78306

8.5HIGH

Key Information:

Vendor

Dji

Status
Neo
Neo 2
Flip
Air 3
Vendor
CVE Published:
24 August 2026

What is CVE-2026-78306?

DJI drones possess a vulnerability that allows attackers within Bluetooth range to send unauthenticated DUML commands. This flaw enables unauthorized modifications to critical Wi-Fi settings, including SSID and PSK, providing attackers potential access to control interfaces of the drone. Consequently, this could lead to significant disruptions in flight operations, including denial-of-service conditions that inhibit the operator's ability to maintain control during use. To mitigate this issue, DJI recommends that users perform a firmware update.

Affected Version(s)

Air 3 0 <= 01.00.1600

Air 3S 0 <= 01.00.1400

Avata 2 0 <= 01.00.0400

References

https://support.dji.com/help/content?customId=en-us034000...
product

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdelrahman Yousef
Dr. Jordan Samhi
.