Skip to main content

DJI Drones CVE-2026-78255

| EUVDEUVD-2026-64746 HIGH
Missing Authentication for Critical Function (CWE-306)
2026-08-24 CIRCL GHSA-mfw9-4mfm-qjg3
Authentication Bypass Neo Neo 2 Flip Air 3 Air 3S Avata 2 Avata 360 Mavic 3 Mavic 3 Classic Mavic 3 Pro Mavic 4 Pro Mini 2 Mini 3 Mini 3 Pro Mini 4 Pro Mini 5 Pro
8.7
CVSS 4.0 · Vendor: CIRCL
Share

Severity by source

Vendor (CIRCL) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Attack requires physical Wi-Fi adjacency to the drone, so AV:A; no authentication required (PR:N); confidentiality-only impact on drone media storage.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CIRCL).

CVSS VectorVendor: CIRCL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 24, 2026 - 08:22 vuln.today
CVE Published
Aug 24, 2026 - 07:25 cve.org
HIGH 8.7

DescriptionCVE.org

The HTTP media server running on DJI drones serves stored photos and videos through the /v2 endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator's routines.

Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.

AnalysisAI

Unauthenticated media exfiltration on sixteen DJI consumer and prosumer drone models allows any attacker who joins the drone's internal Wi-Fi network to enumerate and download all stored photos and videos via the unprotected /v2 HTTP endpoint. The onboard HTTP media server (CWE-306: Missing Authentication for Critical Function) performs no client verification, and DJI's deterministic filename naming convention eliminates any obscurity barrier, making systematic enumeration trivial. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Position within drone Wi-Fi range
Delivery
Connect to drone's local wireless network
Exploit
Send unauthenticated HTTP GET to /v2 endpoint
Execution
Enumerate media files using predictable DJI filename pattern
Persist
Exfiltrate stored photos and videos
Impact
Extract GPS coordinates, identities, and operator routines
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to connect to the drone's internal Wi-Fi network, which mandates physical proximity (typically within 20-100 meters of Wi-Fi range) to the powered-on drone. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) scores 8.7, reflecting high confidentiality impact with no authentication or complexity barriers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker within Wi-Fi range of an operating DJI drone connects to its local wireless network using the drone's default or a compromised Wi-Fi password. The attacker then sends sequential unauthenticated HTTP GET requests to the `/v2` endpoint using DJI's predictable filename pattern (e.g., incrementing counters), downloading all stored photos and videos including GPS-tagged imagery that reveals the operator's flight locations, home address, photographed individuals, and travel history. …
Remediation Update drone firmware via the DJI Fly or DJI GO 4 app to versions above the affected thresholds listed in the DJI advisory at https://support.dji.com/help/content?customId=en-us03400011149. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all DJI drones in use and identify affected models from the sixteen vulnerable product list; disable Wi-Fi on affected drones until patched. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Neo

View all
CVE-2026-78251 CRITICAL
9.3 Aug 24

Persistent storage exhaustion and file overwrite in DJI consumer/prosumer drone firmware allows an attacker with local o
CVE-2026-78306 HIGH
8.5 Aug 24

Unauthenticated access to the DUML command interface over Bluetooth on sixteen DJI drone models allows any attacker with
CVE-2020-5638 MEDIUM
6.1 Dec 03

Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NE
CVE-2026-78321 MEDIUM
6.0 Aug 24

Connection pool exhaustion in the HTTP media server embedded across sixteen DJI consumer and prosumer drone models allow

Same weakness CWE-306 – Missing Authentication for Critical Function

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2024-11680 CRITICAL POC
9.8
CVE-2024-51567 CRITICAL POC
9.8
CVE-2025-0108 HIGH POC
8.8
CVE-2025-32433 CRITICAL POC
10.0
CVE-2016-2004 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-78255 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy