Dji
Monthly
DJI CrystalSky ZS600C firmware 0.3.9.7 through 0.6.6.9 exposes an unauthenticated adbd shell to anyone with physical USB access because the device ships with ro.adb.secure=0 and USB ADB enabled. An attacker can obtain a uid 2000 shell as a foothold for a separate privilege-escalation step to root; ADB over TCP is not enabled by default, but when enabled out-of-band the same unauthenticated shell is reachable over the network. No public exploit was identified at time of analysis and there is no CISA KEV entry; the assessed CVSS 3.1 score is 7.0 (AV:P) because the default path requires physical access, while the reported CVSS 4.0 base score is 9.3.
Local apps on DJI CrystalSky ZS600C devices can invoke system-privileged actions-including a factory reset that wipes user data, shutdown, clock/timezone changes, and a firmware-apply hand-off-because the DJIUpdateService binder does not verify caller identity or permissions. The flaw affects firmware v0.3.9.7 through v0.6.6.9 and is reachable by an installed app with no permissions and no user interaction. No public exploit has been identified at time of analysis; the issue is access-gated to local code execution on the specific device but warrants this-week prioritization because successful abuse is destructive and disruptive.
Local privilege escalation in DJI CrystalSky ZS600C firmware 0.3.9.7 through 0.6.6.9 allows an unprivileged process already running on the Android device to write a crafted line to logcat that the root-privileged hardware_monitor helper passes to a shell eval, resulting in arbitrary command execution as root. The attack is strictly local: the attacker must first obtain a foothold on the device, so this is an escalation primitive rather than a remote entry point. No public exploit was identified at time of analysis, and the published CVSS 4.0 score of 8.6 reflects high confidentiality, integrity, and availability impact once the local prerequisite is met.
Missing authorization in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows a local application with no Android permissions to invoke binder transaction 1018 on android.dji.server and execute arbitrary OS commands as root through the root-privileged assistant daemon. The attack is local only and requires the ability to run code on the physical device; no public exploit has been identified at time of analysis. The reported CVSS 4.0 base score is 8.6 (High), and the independent CVSS 3.1 assessment is AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
An undocumented root-level backdoor in the DJI CrystalSky ZS600C 'assistant' daemon allows a physically present attacker with USB access to execute arbitrary OS commands as root on firmware 0.3.9.7 through 0.6.6.9. Sending the hard-coded string 'dji26656677' to /dev/ttyGS0 unlocks a mode in which each subsequent line is passed to system(), with no authentication or user interaction required once USB access is obtained. The physical-access prerequisite is the dominant limiting factor: devices kept in continuous custody are not exposed, while units that leave custody during shipping, loan, resale or shared use are at risk; no public exploit identified at time of analysis.
Unauthenticated access to the DUML command interface over Bluetooth on sixteen DJI drone models allows any attacker within Bluetooth range to overwrite Wi-Fi credentials, reconfigure wireless parameters, and bridge onto the drone's internal Wi-Fi network - from which the flight control interface is reachable and flight commands can be issued. The vulnerability stems from a complete absence of authentication on a critical management protocol (CWE-306), affecting consumer and prosumer models across the Neo, Flip, Air, Avata, Mavic, and Mini product lines prior to their respective patched firmware versions. Beyond credential hijacking, the same unauthenticated DUML channel permits denial-of-service by disabling or restarting wireless interfaces mid-flight, severing the operator's control, video, and telemetry links - a safety-critical consequence. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated media exfiltration on sixteen DJI consumer and prosumer drone models allows any attacker who joins the drone's internal Wi-Fi network to enumerate and download all stored photos and videos via the unprotected `/v2` HTTP endpoint. The onboard HTTP media server (CWE-306: Missing Authentication for Critical Function) performs no client verification, and DJI's deterministic filename naming convention eliminates any obscurity barrier, making systematic enumeration trivial. Firmware patches have been released per the DJI advisory (en-us03400011149); no public exploit or CISA KEV listing has been confirmed at time of analysis.
Persistent storage exhaustion and file overwrite in DJI consumer/prosumer drone firmware allows an attacker with local or adjacent access to disable flight logging and block firmware updates. The onboard FTP service ships hardcoded credentials shared across affected models (CWE-798), and any party who reaches the drone's internal network or USB RNDIS interface can authenticate and write unlimited files to /blackbox/upgrade/, overwriting existing files. Uploaded data survives reboot and factory reset, making the condition durable. No public exploit identified at time of analysis; CIRCL-reported with CVSS 4.0 base 9.3.
Cleartext exposure of Wi-Fi credentials in DJI consumer and prosumer drones lets an attacker within Bluetooth range recover the drone's Wi-Fi SSID, PSK, and trusted-client UUID by passively sniffing unencrypted DUML-over-BLE messages exchanged during a normal DJI Fly connection or QuickTransfer handoff. This affects a broad range of current DJI models (Neo, Flip, Air 3/3S, Avata 2/360, Mavic 3 family, Mavic 4 Pro, and Mini 2 through Mini 5 Pro) below specific firmware versions. Recovered credentials grant the attacker access to the drone's internal Wi-Fi network and the ability to decrypt the operator's Wi-Fi traffic; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote denial of service attacks against DJI Mavic Mini, Spark, and Mini SE firmware versions 0.1.00.0500 and below can be executed over the network by exploiting the Enhanced-WiFi transmission subsystem without authentication. Public exploit code exists for this vulnerability, and no patch is currently available. An attacker can disrupt drone operations and connectivity by sending specially crafted wireless transmissions to affected devices.
Connection pool exhaustion in the HTTP media server embedded across sixteen DJI consumer and prosumer drone models allows any attacker on the drone's adjacent Wi-Fi network to render QuickTransfer file retrieval inoperable. The server (CWE-770) accepts incoming HTTP connections without rate limiting or concurrent-connection caps, enabling a flood of media requests to saturate the pool and deny service to the legitimate DJI Fly application. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; real-world impact is bounded by the requirement for physical Wi-Fi proximity to the target drone.
DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
DJI CrystalSky ZS600C firmware 0.3.9.7 through 0.6.6.9 exposes an unauthenticated adbd shell to anyone with physical USB access because the device ships with ro.adb.secure=0 and USB ADB enabled. An attacker can obtain a uid 2000 shell as a foothold for a separate privilege-escalation step to root; ADB over TCP is not enabled by default, but when enabled out-of-band the same unauthenticated shell is reachable over the network. No public exploit was identified at time of analysis and there is no CISA KEV entry; the assessed CVSS 3.1 score is 7.0 (AV:P) because the default path requires physical access, while the reported CVSS 4.0 base score is 9.3.
Local apps on DJI CrystalSky ZS600C devices can invoke system-privileged actions-including a factory reset that wipes user data, shutdown, clock/timezone changes, and a firmware-apply hand-off-because the DJIUpdateService binder does not verify caller identity or permissions. The flaw affects firmware v0.3.9.7 through v0.6.6.9 and is reachable by an installed app with no permissions and no user interaction. No public exploit has been identified at time of analysis; the issue is access-gated to local code execution on the specific device but warrants this-week prioritization because successful abuse is destructive and disruptive.
Local privilege escalation in DJI CrystalSky ZS600C firmware 0.3.9.7 through 0.6.6.9 allows an unprivileged process already running on the Android device to write a crafted line to logcat that the root-privileged hardware_monitor helper passes to a shell eval, resulting in arbitrary command execution as root. The attack is strictly local: the attacker must first obtain a foothold on the device, so this is an escalation primitive rather than a remote entry point. No public exploit was identified at time of analysis, and the published CVSS 4.0 score of 8.6 reflects high confidentiality, integrity, and availability impact once the local prerequisite is met.
Missing authorization in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows a local application with no Android permissions to invoke binder transaction 1018 on android.dji.server and execute arbitrary OS commands as root through the root-privileged assistant daemon. The attack is local only and requires the ability to run code on the physical device; no public exploit has been identified at time of analysis. The reported CVSS 4.0 base score is 8.6 (High), and the independent CVSS 3.1 assessment is AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
An undocumented root-level backdoor in the DJI CrystalSky ZS600C 'assistant' daemon allows a physically present attacker with USB access to execute arbitrary OS commands as root on firmware 0.3.9.7 through 0.6.6.9. Sending the hard-coded string 'dji26656677' to /dev/ttyGS0 unlocks a mode in which each subsequent line is passed to system(), with no authentication or user interaction required once USB access is obtained. The physical-access prerequisite is the dominant limiting factor: devices kept in continuous custody are not exposed, while units that leave custody during shipping, loan, resale or shared use are at risk; no public exploit identified at time of analysis.
Unauthenticated access to the DUML command interface over Bluetooth on sixteen DJI drone models allows any attacker within Bluetooth range to overwrite Wi-Fi credentials, reconfigure wireless parameters, and bridge onto the drone's internal Wi-Fi network - from which the flight control interface is reachable and flight commands can be issued. The vulnerability stems from a complete absence of authentication on a critical management protocol (CWE-306), affecting consumer and prosumer models across the Neo, Flip, Air, Avata, Mavic, and Mini product lines prior to their respective patched firmware versions. Beyond credential hijacking, the same unauthenticated DUML channel permits denial-of-service by disabling or restarting wireless interfaces mid-flight, severing the operator's control, video, and telemetry links - a safety-critical consequence. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated media exfiltration on sixteen DJI consumer and prosumer drone models allows any attacker who joins the drone's internal Wi-Fi network to enumerate and download all stored photos and videos via the unprotected `/v2` HTTP endpoint. The onboard HTTP media server (CWE-306: Missing Authentication for Critical Function) performs no client verification, and DJI's deterministic filename naming convention eliminates any obscurity barrier, making systematic enumeration trivial. Firmware patches have been released per the DJI advisory (en-us03400011149); no public exploit or CISA KEV listing has been confirmed at time of analysis.
Persistent storage exhaustion and file overwrite in DJI consumer/prosumer drone firmware allows an attacker with local or adjacent access to disable flight logging and block firmware updates. The onboard FTP service ships hardcoded credentials shared across affected models (CWE-798), and any party who reaches the drone's internal network or USB RNDIS interface can authenticate and write unlimited files to /blackbox/upgrade/, overwriting existing files. Uploaded data survives reboot and factory reset, making the condition durable. No public exploit identified at time of analysis; CIRCL-reported with CVSS 4.0 base 9.3.
Cleartext exposure of Wi-Fi credentials in DJI consumer and prosumer drones lets an attacker within Bluetooth range recover the drone's Wi-Fi SSID, PSK, and trusted-client UUID by passively sniffing unencrypted DUML-over-BLE messages exchanged during a normal DJI Fly connection or QuickTransfer handoff. This affects a broad range of current DJI models (Neo, Flip, Air 3/3S, Avata 2/360, Mavic 3 family, Mavic 4 Pro, and Mini 2 through Mini 5 Pro) below specific firmware versions. Recovered credentials grant the attacker access to the drone's internal Wi-Fi network and the ability to decrypt the operator's Wi-Fi traffic; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote denial of service attacks against DJI Mavic Mini, Spark, and Mini SE firmware versions 0.1.00.0500 and below can be executed over the network by exploiting the Enhanced-WiFi transmission subsystem without authentication. Public exploit code exists for this vulnerability, and no patch is currently available. An attacker can disrupt drone operations and connectivity by sending specially crafted wireless transmissions to affected devices.
Connection pool exhaustion in the HTTP media server embedded across sixteen DJI consumer and prosumer drone models allows any attacker on the drone's adjacent Wi-Fi network to render QuickTransfer file retrieval inoperable. The server (CWE-770) accepts incoming HTTP connections without rate limiting or concurrent-connection caps, enabling a flood of media requests to saturate the pool and deny service to the legitimate DJI Fly application. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; real-world impact is bounded by the requirement for physical Wi-Fi proximity to the target drone.
DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.