CVE-2026-77812 Overview
CVE-2026-77812 is a cryptographic weakness in multiple DJI drone models. The drones exchange DJI Universal Markup Language (DUML) protocol messages over Bluetooth Low Energy (BLE) without encryption. During Wi-Fi association or QuickTransfer mode, the DJI Fly application transmits Wi-Fi credentials, including the Pre-Shared Key (PSK), Service Set Identifier (SSID), and trusted device Universally Unique Identifier (UUID), over this cleartext BLE channel. An attacker within BLE range can passively capture this exchange and gain full access to the drone's internal Wi-Fi network. The flaw maps to [CWE-311: Missing Encryption of Sensitive Data].
Critical Impact
A passive BLE observer recovers persistent Wi-Fi credentials and the trusted client UUID, allowing full network access, traffic decryption, and bypass of physical device pairing confirmation.
Affected Products
- DJI Neo (until 01.00.0400), Neo 2 (until 01.00.0500), Flip (until 01.00.1200)
- DJI Air 3 (until 01.00.1600), Air 3S (until 01.00.1400), Avata 2 (until 01.00.0400), Avata 360 (until 01.00.0300)
- DJI Mavic 3 (until 01.00.1400), Mavic 3 Classic (until 01.00.0800), Mavic 3 Pro (until 01.01.0700), Mavic 4 Pro (until 01.00.0500)
- DJI Mini 2 (until 01.07.0200), Mini 3 (until 01.00.0500), Mini 3 Pro (until 01.00.0900), Mini 4 Pro (until 01.00.1100), Mini 5 Pro (until 01.00.0600)
Discovery Timeline
- 2026-08-21 - CVE-2026-77812 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-77812
Vulnerability Analysis
The vulnerability stems from DJI's decision to transport the DUML control protocol over BLE without a confidentiality layer. DUML is DJI's proprietary command and telemetry protocol used between the DJI Fly mobile application and the aircraft. When a user initiates a Wi-Fi connection or activates QuickTransfer, the mobile app negotiates session parameters over BLE before the higher-bandwidth Wi-Fi channel is established.
Because these BLE frames are unencrypted, the Wi-Fi PSK, SSID, and the trusted client UUID traverse the air in plaintext. The UUID is the sole token the drone uses to distinguish an authorized peer from an unknown device. Any attacker who captures a single legitimate DJI Fly connection obtains all three values.
Once these credentials are known, the attacker can associate with the drone's internal Wi-Fi network, interact with exposed services, replay the trusted UUID to bypass the physical confirmation prompt shown for new devices, and decrypt Wi-Fi traffic between the drone and the legitimate operator.
Root Cause
DJI implemented the DUML transport over BLE without applying application-layer encryption or leveraging BLE Secure Connections pairing. Sensitive material intended for the Wi-Fi layer is emitted before the encrypted Wi-Fi session exists, leaving it exposed on the BLE link.
Attack Vector
The attack requires only a BLE sniffer within radio range of a drone during one normal DJI Fly connection. No transmissions or connections originate from the attacker, so neither the operator nor the drone records any indication of capture. Credentials remain valid across sessions until the operator manually resets the Wi-Fi settings, so a single capture provides indefinite access.
Exploitation is described in prose only; see the DJI Support Help Article for vendor guidance.
Detection Methods for CVE-2026-77812
Indicators of Compromise
- Unknown Wi-Fi clients associated with the drone's SoftAP MAC address, particularly clients presenting the trusted UUID but from a different hardware fingerprint than the operator's device.
- Repeated DJI Fly session activity where the operator did not initiate a flight or QuickTransfer transfer.
- Unexpected access to drone-exposed network services (media transfer, telemetry) from IP addresses outside the operator's device.
Detection Strategies
- Monitor the drone's Wi-Fi association log, when accessible, for MAC addresses that do not match previously enrolled operator devices.
- In sensitive operational environments, use RF spectrum monitoring to identify unauthorized BLE sniffers or Wi-Fi stations near active drone operations.
- Correlate DJI Fly connection events against operator activity to surface sessions the operator did not initiate.
Monitoring Recommendations
- Track firmware versions across drone fleets and alert on any device still running a version listed as affected.
- Log BLE and Wi-Fi environmental scans during flight operations to build a baseline of nearby radios and flag deviations.
How to Mitigate CVE-2026-77812
Immediate Actions Required
- Update every affected drone to the vendor-supplied firmware version that supersedes those listed in the affected products section.
- Manually reset each drone's Wi-Fi settings after updating so that any PSK, SSID, and UUID previously exposed are rotated.
- Restrict drone power-on and DJI Fly pairing to controlled environments where BLE eavesdroppers are unlikely to be present until fleet-wide patching is complete.
Patch Information
Remediation requires a firmware update from DJI. Refer to the DJI Support Help Article for model-specific firmware guidance. There is no user-side mitigation that fully addresses the vulnerability without upgrading, because the credential exchange occurs before any operator-controlled configuration takes effect.
Workarounds
- Minimize DJI Fly pairing operations in public or adversary-accessible areas; BLE range is short but not negligible.
- Rotate Wi-Fi settings through the DJI Fly interface after any suspected exposure so the compromised PSK and UUID no longer authorize access.
- Treat previously paired drones as potentially compromised until firmware is updated and credentials are regenerated.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
