Avata 2
Monthly
Connection pool exhaustion in the HTTP media server embedded across sixteen DJI consumer and prosumer drone models allows any attacker on the drone's adjacent Wi-Fi network to render QuickTransfer file retrieval inoperable. The server (CWE-770) accepts incoming HTTP connections without rate limiting or concurrent-connection caps, enabling a flood of media requests to saturate the pool and deny service to the legitimate DJI Fly application. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; real-world impact is bounded by the requirement for physical Wi-Fi proximity to the target drone.
Unauthenticated access to the DUML command interface over Bluetooth on sixteen DJI drone models allows any attacker within Bluetooth range to overwrite Wi-Fi credentials, reconfigure wireless parameters, and bridge onto the drone's internal Wi-Fi network - from which the flight control interface is reachable and flight commands can be issued. The vulnerability stems from a complete absence of authentication on a critical management protocol (CWE-306), affecting consumer and prosumer models across the Neo, Flip, Air, Avata, Mavic, and Mini product lines prior to their respective patched firmware versions. Beyond credential hijacking, the same unauthenticated DUML channel permits denial-of-service by disabling or restarting wireless interfaces mid-flight, severing the operator's control, video, and telemetry links - a safety-critical consequence. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated media exfiltration on sixteen DJI consumer and prosumer drone models allows any attacker who joins the drone's internal Wi-Fi network to enumerate and download all stored photos and videos via the unprotected `/v2` HTTP endpoint. The onboard HTTP media server (CWE-306: Missing Authentication for Critical Function) performs no client verification, and DJI's deterministic filename naming convention eliminates any obscurity barrier, making systematic enumeration trivial. Firmware patches have been released per the DJI advisory (en-us03400011149); no public exploit or CISA KEV listing has been confirmed at time of analysis.
Persistent storage exhaustion and file overwrite in DJI consumer/prosumer drone firmware allows an attacker with local or adjacent access to disable flight logging and block firmware updates. The onboard FTP service ships hardcoded credentials shared across affected models (CWE-798), and any party who reaches the drone's internal network or USB RNDIS interface can authenticate and write unlimited files to /blackbox/upgrade/, overwriting existing files. Uploaded data survives reboot and factory reset, making the condition durable. No public exploit identified at time of analysis; CIRCL-reported with CVSS 4.0 base 9.3.
Connection pool exhaustion in the HTTP media server embedded across sixteen DJI consumer and prosumer drone models allows any attacker on the drone's adjacent Wi-Fi network to render QuickTransfer file retrieval inoperable. The server (CWE-770) accepts incoming HTTP connections without rate limiting or concurrent-connection caps, enabling a flood of media requests to saturate the pool and deny service to the legitimate DJI Fly application. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; real-world impact is bounded by the requirement for physical Wi-Fi proximity to the target drone.
Unauthenticated access to the DUML command interface over Bluetooth on sixteen DJI drone models allows any attacker within Bluetooth range to overwrite Wi-Fi credentials, reconfigure wireless parameters, and bridge onto the drone's internal Wi-Fi network - from which the flight control interface is reachable and flight commands can be issued. The vulnerability stems from a complete absence of authentication on a critical management protocol (CWE-306), affecting consumer and prosumer models across the Neo, Flip, Air, Avata, Mavic, and Mini product lines prior to their respective patched firmware versions. Beyond credential hijacking, the same unauthenticated DUML channel permits denial-of-service by disabling or restarting wireless interfaces mid-flight, severing the operator's control, video, and telemetry links - a safety-critical consequence. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated media exfiltration on sixteen DJI consumer and prosumer drone models allows any attacker who joins the drone's internal Wi-Fi network to enumerate and download all stored photos and videos via the unprotected `/v2` HTTP endpoint. The onboard HTTP media server (CWE-306: Missing Authentication for Critical Function) performs no client verification, and DJI's deterministic filename naming convention eliminates any obscurity barrier, making systematic enumeration trivial. Firmware patches have been released per the DJI advisory (en-us03400011149); no public exploit or CISA KEV listing has been confirmed at time of analysis.
Persistent storage exhaustion and file overwrite in DJI consumer/prosumer drone firmware allows an attacker with local or adjacent access to disable flight logging and block firmware updates. The onboard FTP service ships hardcoded credentials shared across affected models (CWE-798), and any party who reaches the drone's internal network or USB RNDIS interface can authenticate and write unlimited files to /blackbox/upgrade/, overwriting existing files. Uploaded data survives reboot and factory reset, making the condition durable. No public exploit identified at time of analysis; CIRCL-reported with CVSS 4.0 base 9.3.