CVE-2026-78255: DJI Drone Information Disclosure Vulnerability

CVE-2026-78255 Overview

CVE-2026-78255 is a missing authentication vulnerability [CWE-306] in the HTTP media server running on multiple DJI drone models. The server exposes stored photos and videos through the /v2 endpoint without validating the requesting client. Because filenames follow a predictable pattern, an attacker on the drone's internal network can enumerate valid filenames and exfiltrate stored media. The exposed content may reveal private locations, property, travel history, identifiable individuals, and the operator's routines.

Critical Impact
Any client that joins the drone's internal Wi-Fi network can retrieve stored photos and videos without credentials, exposing sensitive operator and subject data.

Affected Products

DJI Neo prior to 01.00.0400, DJI Neo 2 prior to 01.00.0500, DJI Flip prior to 01.00.1200
DJI Air 3 prior to 01.00.1600, DJI Air 3S prior to 01.00.1400, DJI Avata 2 prior to 01.00.0400, DJI Avata 360 prior to 01.00.0300
DJI Mavic 3 prior to 01.00.1400, Mavic 3 Classic prior to 01.00.0800, Mavic 3 Pro prior to 01.01.0700, Mavic 4 Pro prior to 01.00.0500, and the DJI Mini 2, Mini 3, Mini 3 Pro, Mini 4 Pro, and Mini 5 Pro before their respective fixed firmware releases

Discovery Timeline

2026-08-24 - CVE-2026-78255 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78255

Vulnerability Analysis

DJI drones expose an HTTP media server that serves stored photos and videos. Requests to the /v2 endpoint return media files directly, without any authentication challenge. The server assumes network-layer isolation is sufficient, so any client joined to the drone's internal Wi-Fi network is treated as trusted.

Filenames follow a predictable naming convention. An attacker can enumerate candidate filenames by iterating through known patterns and issue direct HTTP GET requests to retrieve each file. The result is unauthenticated bulk exfiltration of media captured by the drone.

The impact is confidentiality-focused. Exfiltrated photos and videos can disclose home and office locations, protected facilities, license plates, faces, and behavioral patterns of the operator.

Root Cause

The root cause is Missing Authentication for a Critical Function [CWE-306]. The HTTP media server does not require credentials, tokens, or session validation before serving files from /v2. Combined with predictable filename schemes, this eliminates both authentication and enumeration resistance.

Attack Vector

The attack vector is network-based and requires the attacker to join the drone's internal network. Once connected, the attacker sends HTTP requests to the media server and iterates predictable filenames to enumerate valid media objects. No user interaction on the operator side is required. See the DJI Support Article for vendor guidance.

No verified public exploit code is available. The vulnerability is described in prose because filename patterns and endpoint behavior are documented by the vendor rather than in a released proof of concept.

Detection Methods for CVE-2026-78255

Indicators of Compromise

Unexpected HTTP GET requests to the /v2 endpoint on the drone's IP address originating from devices other than the paired controller or mobile app
Sequential or brute-force-style enumeration patterns against predictable media filenames
Unknown clients associated with the drone's Wi-Fi SSID during or after flight sessions

Detection Strategies

Capture Wi-Fi traffic between the drone and controller and inspect for HTTP requests to /v2 from unexpected MAC addresses or IPs
Alert on high-volume GET request bursts to the drone's media server consistent with filename enumeration
Correlate drone Wi-Fi association events with the operator's known controller and phone MAC addresses

Monitoring Recommendations

Monitor the drone's local Wi-Fi network for rogue clients during pre-flight, flight, and post-flight windows
Log and review firmware versions across fleet drones to confirm patched builds are deployed
Track physical proximity risk in operating environments where untrusted devices may be within Wi-Fi range

How to Mitigate CVE-2026-78255

Immediate Actions Required

Update each affected DJI model to the fixed firmware version listed in the vendor advisory before further operational use
Change the drone's Wi-Fi SSID and password from defaults and use a strong pre-shared key to limit network access
Avoid operating unpatched drones in areas where untrusted Wi-Fi clients may associate with the drone's network

Patch Information

DJI has released firmware updates that remediate the missing authentication on the /v2 media endpoint. Operators should upgrade to the vendor-specified minimum versions: DJI Neo 01.00.0400, Neo 2 01.00.0500, Flip 01.00.1200, Air 3 01.00.1600, Air 3S 01.00.1400, Avata 2 01.00.0400, Avata 360 01.00.0300, Mavic 3 01.00.1400, Mavic 3 Classic 01.00.0800, Mavic 3 Pro 01.01.0700, Mavic 4 Pro 01.00.0500, Mini 2 01.07.0200, Mini 3 01.00.0500, Mini 3 Pro 01.00.0900, Mini 4 Pro 01.00.1100, and Mini 5 Pro 01.00.0600. Refer to the DJI Support Article for firmware download instructions.

Workarounds

Delete sensitive media from onboard storage after each flight and offload to secured storage
Power the drone off when not actively flying to eliminate the exposed Wi-Fi network
Restrict flight operations to controlled RF environments until firmware updates are applied across the fleet

bash

# Configuration example: verify installed firmware version meets the patched minimum
# (Perform via DJI Fly / DJI RC controller settings)
# 1. Open DJI Fly or the RC controller
# 2. Navigate to: Settings > About > Firmware Version
# 3. Confirm the version is at or above the fixed release for your model
# 4. If not, run: Settings > About > Check for Updates