DJI drones CVE-2026-78251

Exploitation requires network-path access to the drone's internal WiFi network OR a physical/USB connection to its RNDIS interface - it is not exploitable from the public Internet. The attacker must reach the onboard FTP service and authenticate with the model-shared hardcoded credentials (effectively no barrier once the credential is known). No user interaction, no operator privileges, and no non-default configuration are needed: the FTP service, hardcoded credentials, and unbounded writable /blackbox/upgrade/ directory are present by default on vulnerable firmware. Limiting factors that reduce realistic risk: the required proximity (WiFi range or physical USB access), and that impact is confined to persistent storage/logging and firmware-update denial rather than takeover of flight control.

The signals partially conflict and should be weighed carefully. The vendor/CIRCL CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) yields a 9.3 CRITICAL, but AV:N appears optimistic: the description explicitly scopes access to 'the drone's internal network or USB RNDIS interface,' which is adjacent/local rather than routable Internet - this is an important discrepancy defenders should note, as it materially lowers real-world exposure versus a true remote-network flaw. PR:N is defensible despite the FTP requiring login, because the credentials are hardcoded and shared, so effectively no authentication barrier exists. The rated confidentiality-High (VC:H) is not well supported by the description, which centers on upload/overwrite and storage exhaustion - the demonstrable impacts are integrity (arbitrary persistent file writes) and availability (loss of flight recording and blocked firmware updates), not data disclosure. No EPSS score, KEV listing, or POC was provided, so exploitation probability cannot be quantified; treat this as a proximity-gated, high-impact-to-availability issue rather than an Internet-wormable critical.

An attacker within WiFi range of the aircraft, or with brief physical access to plug into the USB RNDIS interface, logs into the FTP service using the publicly known hardcoded credentials and uploads large or numerous files to /blackbox/upgrade/ until flash storage is exhausted. The drone can no longer write flight records, logs, or telemetry and may refuse subsequent firmware updates, and because the data persists across reboot and factory reset the sabotage is durable. No POC was provided, but the low attack complexity and absence of a real authentication barrier make exploitation straightforward for anyone with link access.