DJI Drones CVE-2026-78321

The attacker must have adjacent network access to the drone's Wi-Fi interface (AV:A confirmed by CVSS 4.0 vector), placing the attacker within Wi-Fi radio range - typically 30 to 100 metres depending on environment and antenna. Critically, the drone must be operating in QuickTransfer mode with its HTTP media server active; this mode is not the default flight state and must be deliberately initiated by the operator after landing. No authentication is required once adjacent network access is obtained (PR:N). No user interaction from the drone operator is needed to trigger the vulnerability (UI:N). Key limiting factors: physical proximity is mandatory and cannot be bypassed remotely; impact is strictly confined to the media-transfer function and does not affect flight control, GPS, camera, or any other drone subsystem; and the attack window is bounded by how long the operator leaves the drone in QuickTransfer mode.

The CVSS 4.0 score of 6.0 (AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) accurately captures the bounded risk profile. The adjacent-network attack vector (AV:A) is the primary real-world constraint: exploitation demands Wi-Fi proximity to the drone, dramatically narrowing the attacker population to individuals within radio range. AT:P further indicates that specific conditions - the drone must be in QuickTransfer mode with the media server active - must be satisfied for the attack to succeed. The vulnerability carries no confidentiality or integrity impact; only the media transfer availability (VA:H) is affected, meaning flight control, telemetry, and other drone systems are out of scope. No EPSS data was provided in the input, so probabilistic exploitation forecasting cannot be performed. The absence of a KEV listing and the lack of any identified POC code collectively suggest this is not under active widespread exploitation. The net assessment is a real but operationally limited vulnerability: the most credible threat scenario is a nearby party disrupting a drone operator's post-flight media download, not any form of persistent compromise.

An attacker physically near a drone in QuickTransfer mode joins or associates with the drone's Wi-Fi network, then uses a script or tool to rapidly open many concurrent HTTP connections to the drone's media server and repeatedly request the same stored media file. Within seconds the server's connection pool saturates, causing subsequent legitimate connection attempts from the operator's DJI Fly application to be rejected, halting photo and video retrieval for the duration of the attack. No exploit code has been identified at time of analysis, but the attack is trivially constructable using standard HTTP load-testing utilities.