CVE-2026-78306

CVE-2026-78306 — Inyección de comandos DUML de DJI a través de Bluetooth POC Descripción Los drones DJI exponen una interfaz Bluetooth utilizada para establecer una conexión con la interfaz Wi-Fi del dron e intercambiar credenciales Wi-Fi. La interfaz Bluetooth verifica el UUID de confianza del...

CVE-2026-78306

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a...

CVE-2026-78306 DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a...

EUVD-2026-64752

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a...

CVE-2026-78306

DJI drones expose an unauthenticated DUML command interface over Bluetooth , allowing an attacker within Bluetooth range to modify Wi-Fi configuration parameters (SSID, PSK, MAC, regulatory country code, channel). By overwriting the Wi-Fi PSK with a known value, an attacker can connect to the dro...

PT-2026-79838

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...

CVE-2026-77812

DJI drones transmit DUML DJI Universal Markup Language protocol messages over BLE Bluetooth Low Energy without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone...

EUVD-2026-63973

DJI drones transmit DUML DJI Universal Markup Language protocol messages over BLE Bluetooth Low Energy without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone...

CVE-2026-77812 Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE

DJI drones transmit DUML DJI Universal Markup Language protocol messages over BLE Bluetooth Low Energy without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone...

CVE-2026-77812 Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE

DJI drones transmit DUML DJI Universal Markup Language protocol messages over BLE Bluetooth Low Energy without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone...

CVE-2026-77812

CVE-2026-77812 is a critical (CVSS 4.0: 9.4) vulnerability in DJI drones where DUML protocol messages transmitted over BLE are unencrypted . During a normal DJI Fly Wi-Fi connection or QuickTransfer mode, the drone's Wi-Fi PSK, SSID, and trusted session UUID are exposed in cleartext. A passive at...

PT-2026-79388

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...