DJI Drones EUVD-2026-64746

Exploitation requires the attacker to connect to the drone's internal Wi-Fi network, which mandates physical proximity (typically within 20-100 meters of Wi-Fi range) to the powered-on drone. The HTTP media server must be active, which occurs during normal drone operation. The attack is further enabled by DJI's deterministic filename naming convention, which removes the need for brute-force guessing of arbitrary identifiers. Limiting factors include: the operator may set a strong non-default Wi-Fi password, restricting who can join the network; the exploitation window is bounded by powered-on flight or connection sessions; and the attacker must be physically co-located with the drone. The CVSS 4.0 PR:N metric confirms no server-side authentication is required once network access is achieved. The attack does not require any interaction from the drone operator.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) scores 8.7, reflecting high confidentiality impact with no authentication or complexity barriers. However, AV:N may overstate exploitability: the attacker must physically connect to the drone's local wireless network, which more precisely maps to AV:A (Adjacent Network) in practice, since Wi-Fi range imposes a physical proximity constraint of roughly 20-100 meters. Despite this nuance, once network access is obtained, exploitation requires zero technical sophistication - standard HTTP GET requests to predictable /v2 paths suffice. The confidentiality impact is genuinely severe: exfiltrated media may contain GPS metadata, facial imagery, private property, and operator routine patterns, creating significant privacy and operational security risk, especially for law enforcement, military, or journalist operators. No EPSS score was provided; however, the trivial attack mechanics, the large installed base across sixteen models, and the sensitive nature of the exfiltrated data suggest defenders should prioritize firmware patching. No KEV listing and no public POC have been identified at time of analysis; exploitation is not confirmed as widespread, though the attack barrier is extremely low.

An attacker within Wi-Fi range of an operating DJI drone connects to its local wireless network using the drone's default or a compromised Wi-Fi password. The attacker then sends sequential unauthenticated HTTP GET requests to the /v2 endpoint using DJI's predictable filename pattern (e.g., incrementing counters), downloading all stored photos and videos including GPS-tagged imagery that reveals the operator's flight locations, home address, photographed individuals, and travel history. No proof-of-concept code has been publicly identified, but the attack requires only basic HTTP tooling and knowledge of DJI's filename scheme.