CVE-2026-78306: DJI Drone Bluetooth DOS Vulnerability

CVE-2026-78306 Overview

CVE-2026-78306 is a missing authentication vulnerability [CWE-306] affecting a broad range of DJI consumer drones. The drones expose an unauthenticated DJI Universal Markup Language (DUML) command interface over Bluetooth. An attacker within Bluetooth range can modify Wi-Fi configuration parameters, including the Service Set Identifier (SSID), Pre-Shared Key (PSK), Media Access Control (MAC) address, regulatory country code, and wireless channel. The attacker can overwrite the PSK with a known value, connect to the drone's internal Wi-Fi network, and reach the flight control interface. Crafted DUML commands can also disable or restart Wi-Fi and Bluetooth, disconnect clients, or reset wireless configuration, producing a denial-of-service condition during flight.

Critical Impact
An adjacent attacker can hijack a drone's Wi-Fi credentials and issue flight commands, or disrupt operator control, video, and telemetry mid-flight.

Affected Products

DJI Neo (before 01.00.0400), DJI Neo 2 (before 01.00.0500), DJI Flip (before 01.00.1200)
DJI Air 3 (before 01.00.1600), DJI Air 3S (before 01.00.1400), DJI Avata 2 (before 01.00.0400), DJI Avata 360 (before 01.00.0300)
DJI Mavic 3 (before 01.00.1400), Mavic 3 Classic (before 01.00.0800), Mavic 3 Pro (before 01.01.0700), Mavic 4 Pro (before 01.00.0500)
DJI Mini 2 (before 01.07.0200), Mini 3 (before 01.00.0500), Mini 3 Pro (before 01.00.0900), Mini 4 Pro (before 01.00.1100), Mini 5 Pro (before 01.00.0600)

Discovery Timeline

2026-08-24 - CVE-2026-78306 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78306

Vulnerability Analysis

DJI drones implement a DUML command channel over Bluetooth Low Energy that accepts commands without authenticating the peer. DUML is DJI's internal binary protocol used to control device configuration and firmware operations. Because the Bluetooth transport does not enforce pairing-based authentication or command-level authorization, any device within radio range can issue privileged configuration commands. The command set exposed on this channel includes wireless configuration primitives that normally would only be reachable from an authenticated management context.

The attacker's most direct path is overwriting the Wi-Fi PSK and SSID with attacker-controlled values, then associating to the drone's Wi-Fi as a legitimate client. Once associated, the flight control interface used by the operator's remote application becomes reachable, permitting the attacker to send flight commands. Alternative DUML commands on the same channel disable or restart the Wi-Fi and Bluetooth radios, force client disconnects, or reset wireless configuration, breaking the operator's control link, live video feed, and telemetry.

Root Cause

The root cause is missing authentication on a privileged control interface [CWE-306]. The Bluetooth DUML handler treats any peer as authorized to invoke wireless configuration commands. There is no cryptographic binding between the operator's controller and the drone at the DUML layer, and no per-command authorization check.

Attack Vector

The attack vector is Adjacent Network. The attacker must be within Bluetooth radio range of the target drone, but does not require pairing, credentials, prior access, or user interaction on the operator side. Exploitation is feasible before takeoff during boot and radio initialization, and in some scenarios during flight while the Bluetooth stack remains active.

No verified proof-of-concept code has been published. Technical details are described in prose only; refer to the DJI Support Article for vendor-specific guidance.

Detection Methods for CVE-2026-78306

Indicators of Compromise

Unexpected changes to a drone's Wi-Fi SSID, PSK, MAC address, regulatory country code, or channel between flights.
Unplanned disconnects of the operator's remote application from the drone's Wi-Fi during pre-flight or flight.
Presence of unknown Wi-Fi clients associated to the drone's internal access point.
Unexplained restarts of the drone's Wi-Fi or Bluetooth radios recorded in flight logs.

Detection Strategies

Baseline expected drone Wi-Fi configuration per airframe and alert on drift observed in the DJI Fly or Pilot app.
Perform Bluetooth spectrum monitoring in operational areas to identify unauthorized devices attempting to interact with drone BLE services.
Review DJI flight logs after each flight for radio subsystem resets, client disconnect events, and configuration changes.

Monitoring Recommendations

Enforce pre-flight checklists that verify SSID and wireless channel match the fleet baseline.
Track firmware versions across the fleet and alert when any airframe reports a version older than the fixed release listed by DJI.
In sensitive operations, monitor for anomalous 2.4 GHz and 5 GHz activity near the pilot station that could indicate an adjacent attacker.

How to Mitigate CVE-2026-78306

Immediate Actions Required

Update each affected drone to a firmware version at or above the fixed release listed for that model in the Affected Products section.
Do not operate vulnerable airframes in environments where an adjacent attacker may be within Bluetooth range, such as public events or contested areas.
Verify firmware version on every airframe before flight and quarantine any device still on a vulnerable build.

Patch Information

Remediation requires a firmware update from the vendor. Fixed firmware versions are enumerated per model above. Consult the DJI Support Article for release notes and update procedures using the DJI Fly or DJI Assistant tooling.

Workarounds

Disable Bluetooth on the drone where the model and firmware permit, and rely on the standard controller link only.
Power the drone on only immediately before flight and power it off immediately after, minimizing the window in which the Bluetooth DUML interface is reachable.
Operate in areas with controlled physical perimeters that keep potential attackers outside Bluetooth range, typically beyond several tens of meters.

bash

# Verify installed firmware version against the fixed baseline
# (perform via DJI Fly / DJI Assistant 2 UI; no CLI is exposed by the vendor)
# Example baseline check pseudocode:
#   if firmware_version < fixed_version_for_model:
#     status = "VULNERABLE - update required"
#   else:
#     status = "PATCHED"