EUVD-2026-64745
GHSA-jv3m-r2mc-76vq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Access is limited to the drone's WiFi/USB link (AV:A), hardcoded shared credentials mean no real auth (PR:N); impact is persistent arbitrary writes (I:H) and storage-exhaustion DoS (A:H) with no disclosure shown (C:N).
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An attacker with access to the drone's internal network or USB RNDIS interface can exhaust the available storage, preventing the aircraft from writing flight records, logs, and telemetry and potentially preventing subsequent firmware updates. Uploaded files persist across reboot and factory reset.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor.
AnalysisAI
Persistent storage exhaustion and file overwrite in DJI consumer/prosumer drone firmware allows an attacker with local or adjacent access to disable flight logging and block firmware updates. The onboard FTP service ships hardcoded credentials shared across affected models (CWE-798), and any party who reaches the drone's internal network or USB RNDIS interface can authenticate and write unlimited files to /blackbox/upgrade/, overwriting existing files. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network-path access to the drone's internal WiFi network OR a physical/USB connection to its RNDIS interface - it is not exploitable from the public Internet. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals partially conflict and should be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker within WiFi range of the aircraft, or with brief physical access to plug into the USB RNDIS interface, logs into the FTP service using the publicly known hardcoded credentials and uploads large or numerous files to /blackbox/upgrade/ until flash storage is exhausted. The drone can no longer write flight records, logs, or telemetry and may refuse subsequent firmware updates, and because the data persists across reboot and factory reset the sabotage is durable. … |
| Remediation | Apply the vendor firmware update for each affected model to at least the fixed version listed above (e.g., Neo 01.00.0400, Air 3 01.00.1600, Mavic 3 Pro 01.01.0700, Mini 5 Pro 01.00.0600); this is the only complete fix since the hardcoded credential and missing quota cannot be reconfigured by the operator. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all affected DJI drone models and document current firmware versions; segregate drones from corporate networks and restrict USB access to authorized personnel. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated media exfiltration on sixteen DJI consumer and prosumer drone models allows any attacker who joins the d
Unauthenticated access to the DUML command interface over Bluetooth on sixteen DJI drone models allows any attacker with
Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NE
Connection pool exhaustion in the HTTP media server embedded across sixteen DJI consumer and prosumer drone models allow
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today