DJI drones EUVD-2026-63973

Exploitation requires the attacker to be within BLE range of the drone (or its controlling phone) at the moment the DJI Fly app performs a Wi-Fi connection or the drone is switched to QuickTransfer mode - that connection event is the exact trigger that causes the unencrypted DUML credential exchange over BLE. No authentication and no attacker-side interaction are needed (PR:N/UI:N), and the capture is entirely passive, so nothing is transmitted and neither drone nor operator sees any indication. Limiting factors: the Adjacent (AV:A/BLE) vector means physical proximity during a live session is mandatory, so this is a proximity/targeted attack, not remote; the exposure only occurs when the operator actually initiates a Wi-Fi/QuickTransfer connection; and the affected firmware must be below the fixed version for the specific model. A key aggravator is that captured credentials remain valid indefinitely unless the operator manually resets the drone's Wi-Fi settings.

This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 4.0 base is 9.4 (AV:A/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems), and the attack is fully passive, low-complexity, and requires no authentication or user interaction from the attacker's side. The main risk-limiting factor is the AV:A (Adjacent) vector - the attacker must be within BLE range during an actual DJI Fly connection event - which constrains this to a proximity/targeted attack rather than internet-wide mass exploitation, consistent with the absence of any EPSS-scale worming potential. No EPSS score, POC, or KEV entry is provided, so there is no evidence of active exploitation; however, the durability of the leak (credentials persist across sessions until manually reset) and the total lack of detectability meaningfully raise real-world risk for anyone operating these drones in contested or public environments. Even a mid-sized commercial or public-safety drone operator should treat this as urgent because a single capture stays valid indefinitely.

An attacker positions a commodity BLE sniffer within radio range of a DJI operator (for example, at a public flying field or event) and passively records the BLE traffic while the operator makes a normal DJI Fly connection or triggers QuickTransfer. From that single capture the attacker extracts the drone's Wi-Fi SSID, PSK, and trust UUID, then later joins the drone's internal network and replays the UUID to be treated as an already-trusted device - skipping the physical new-device confirmation - while also decrypting the operator's Wi-Fi traffic. No public exploit code is identified, but the attack requires only inexpensive hardware and proximity.