EUVD-2026-64756
GHSA-478p-8v46-gwpv
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent network required (AV:A); no auth or interaction needed; scope unchanged and impact limited to availability of the media server.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling legitimate requests and causing a denial of service that prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor.
AnalysisAI
Connection pool exhaustion in the HTTP media server embedded across sixteen DJI consumer and prosumer drone models allows any attacker on the drone's adjacent Wi-Fi network to render QuickTransfer file retrieval inoperable. The server (CWE-770) accepts incoming HTTP connections without rate limiting or concurrent-connection caps, enabling a flood of media requests to saturate the pool and deny service to the legitimate DJI Fly application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have adjacent network access to the drone's Wi-Fi interface (AV:A confirmed by CVSS 4.0 vector), placing the attacker within Wi-Fi radio range - typically 30 to 100 metres depending on environment and antenna. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.0 (AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) accurately captures the bounded risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker physically near a drone in QuickTransfer mode joins or associates with the drone's Wi-Fi network, then uses a script or tool to rapidly open many concurrent HTTP connections to the drone's media server and repeatedly request the same stored media file. Within seconds the server's connection pool saturates, causing subsequent legitimate connection attempts from the operator's DJI Fly application to be rejected, halting photo and video retrieval for the duration of the attack. … |
| Remediation | The primary fix is a firmware update delivered through the DJI Fly application; operators should update each affected drone to the minimum fixed firmware version listed above (e.g., DJI Mini 4 Pro to 01.00.1100 or later). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Persistent storage exhaustion and file overwrite in DJI consumer/prosumer drone firmware allows an attacker with local o
Unauthenticated media exfiltration on sixteen DJI consumer and prosumer drone models allows any attacker who joins the d
Unauthenticated access to the DUML command interface over Bluetooth on sixteen DJI drone models allows any attacker with
Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NE
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today