EUVD-2026-64752
GHSA-vq46-xr65-w8q7
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent Bluetooth vector with no authentication; scope changes as attacker pivots from Bluetooth to the drone's internal Wi-Fi and flight control system, and limited confidentiality exposure arises from internal network access.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone's internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator's wireless control, video, and telemetry connections during flight.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor.
AnalysisAI
Unauthenticated access to the DUML command interface over Bluetooth on sixteen DJI drone models allows any attacker within Bluetooth range to overwrite Wi-Fi credentials, reconfigure wireless parameters, and bridge onto the drone's internal Wi-Fi network - from which the flight control interface is reachable and flight commands can be issued. The vulnerability stems from a complete absence of authentication on a critical management protocol (CWE-306), affecting consumer and prosumer models across the Neo, Flip, Air, Avata, Mavic, and Mini product lines prior to their respective patched firmware versions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Bluetooth interface on affected DJI drones exposes the DUML command channel by default in all vulnerable firmware versions - no non-default configuration is required on the target drone. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.5 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H) correctly frames the threat: adjacent Bluetooth access, zero authentication, low complexity, and high integrity and availability impact cascading to subsequent systems including the flight control chain. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker carrying a Bluetooth-capable laptop or mobile device approaches within range of a DJI drone during pre-flight setup or active flight, crafts unauthenticated DUML commands over Bluetooth to overwrite the drone's Wi-Fi PSK with a value of their choosing, then connects their device to the drone's internal Wi-Fi network and accesses the flight control interface to issue unauthorized commands. Alternatively, the same attacker sends DUML commands to restart or disable the drone's wireless interfaces mid-flight, immediately severing the legitimate operator's control link, video feed, and telemetry without any warning. … |
| Remediation | The authoritative fix is a firmware update from DJI to the patched version for each affected model: Neo to 01.00.0400, Neo 2 to 01.00.0500, Flip to 01.00.1200, Air 3 to 01.00.1600, Air 3S to 01.00.1400, Avata 2 to 01.00.0400, Avata 360 to 01.00.0300, Mavic 3 to 01.00.1400, Mavic 3 Classic to 01.00.0800, Mavic 3 Pro to 01.01.0700, Mavic 4 Pro to 01.00.0500, Mini 2 to 01.07.0200, Mini 3 to 01.00.0500, Mini 3 Pro to 01.00.0900, Mini 4 Pro to 01.00.1100, and Mini 5 Pro to 01.00.0600. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit inventory to identify all affected DJI models in operational use and suspend Bluetooth-dependent operations except in isolated, controlled environments for essential pre-flight configuration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Persistent storage exhaustion and file overwrite in DJI consumer/prosumer drone firmware allows an attacker with local o
Unauthenticated media exfiltration on sixteen DJI consumer and prosumer drone models allows any attacker who joins the d
Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NE
Connection pool exhaustion in the HTTP media server embedded across sixteen DJI consumer and prosumer drone models allow
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today