DJI Drones CVE-2026-78306

The Bluetooth interface on affected DJI drones exposes the DUML command channel by default in all vulnerable firmware versions - no non-default configuration is required on the target drone. Exploitation requires only that the attacker be within Bluetooth range (standard range approximately 10-100 meters; potentially extended with directional hardware or in open environments) and possess knowledge of the DUML command structure. For the integrity escalation path (gaining flight control access), the attack is two-stage: (1) overwrite Wi-Fi PSK via Bluetooth DUML, then (2) authenticate to the drone's Wi-Fi with the newly set PSK - both steps require no credentials or authentication on the drone's side. For the denial-of-service path (disabling wireless interfaces), only Bluetooth access is required with no follow-on step. Exploitation is bounded by physical Bluetooth proximity and does not function remotely over the internet. The drone must be powered on and operational for the Bluetooth interface to be active.

The CVSS 4.0 score of 8.5 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H) correctly frames the threat: adjacent Bluetooth access, zero authentication, low complexity, and high integrity and availability impact cascading to subsequent systems including the flight control chain. The AV:A adjacency constraint is the primary limiting factor for mass exploitation - standard Bluetooth range is 10-100 meters - but directional Bluetooth hardware can extend this, and high-density environments such as parks, airshows, and critical-infrastructure inspection sites create natural target aggregation. Notably, the denial-of-service path (wireless interface restart or disable) requires only the Bluetooth channel and has direct safety implications: loss of operator control or telemetry during flight is not a conventional IT availability loss but a physical safety event. The integrity escalation path (PSK overwrite → Wi-Fi join → flight command issuance) is a two-stage attack but requires no authentication at either stage. No EPSS data was provided; the CVE is not in the CISA KEV catalog and no public exploit code has been identified, which tempers urgency for opportunistic mass exploitation, but the low attack complexity and complete absence of authentication mean exploitation is accessible to any actor with DUML protocol knowledge and Bluetooth hardware. Professional operators, law enforcement, and critical-infrastructure drone deployments should treat this as a high-priority patch given the safety consequences of in-flight disruption.

An attacker carrying a Bluetooth-capable laptop or mobile device approaches within range of a DJI drone during pre-flight setup or active flight, crafts unauthenticated DUML commands over Bluetooth to overwrite the drone's Wi-Fi PSK with a value of their choosing, then connects their device to the drone's internal Wi-Fi network and accesses the flight control interface to issue unauthorized commands. Alternatively, the same attacker sends DUML commands to restart or disable the drone's wireless interfaces mid-flight, immediately severing the legitimate operator's control link, video feed, and telemetry without any warning. No public exploit code has been identified at time of analysis, but the attack requires only knowledge of the DUML protocol format and standard Bluetooth hardware.