In short: Technical details for CVE-2026-78306 (CVSS 8.5) in DJI drones are now public. The Bluetooth interface on 16 popular DJI product lines lacks authentication for critical commands: anyone within Bluetooth range can silently steal the drone's Wi-Fi credentials and gain access to the flight control interface — no password required. Firmware updates are available from DJI and should be applied immediately.
What happened
On September 22, 2026, security researchers published technical details for CVE-2026-78306, rated CVSS 8.5 / High under the CVSS 4.0 framework. The CVE was formally registered by CIRCL on August 24, 2026, but public technical details — including a proof-of-concept on GitHub — only appeared now.
The vulnerability is classified as CWE-306 — Missing Authentication for Critical Function. This is one of the most common design flaws in consumer IoT devices: manufacturers add convenient Bluetooth interfaces without enforcing proper authentication for the commands they expose. Learn more about layered device security on the LiMP VPN features page.
How the attack works
DJI drones use a proprietary command protocol called DUML (DJI Unified Markup Language). The Bluetooth interface only validates authentication for three Wi-Fi-related operations — all other commands are unauthenticated. An attacker within Bluetooth range (typically 10–100 metres) can, without any credentials:
- Change the drone's Wi-Fi SSID and password (PSK) to values of their choosing;
- Connect to the drone's internal Wi-Fi network and access the flight control interface;
- Disable Wi-Fi and Bluetooth on the drone, cutting the operator's connection (DoS);
- Reset wireless configuration or reboot drone components;
- Delete stored device configurations.
The most dangerous scenario is seizing control of the drone mid-flight: once Wi-Fi credentials are overwritten, the attacker inserts themselves between the operator and the device. No real-world exploitation has been reported yet, but the PoC code is now public — significantly lowering the barrier for attackers.
Which DJI models are affected
The vulnerability affects 16 DJI product lines — covering virtually the entire consumer and prosumer range. The full list with the last known vulnerable firmware versions:
- DJI Neo (≤01.00.0400) and Neo 2
- DJI Flip
- DJI Air 3 (≤01.00.1600) and Air 3S
- DJI Avata 2 and Avata 360
- DJI Mavic 3, Mavic 3 Classic, Mavic 3 Pro, Mavic 4 Pro
- DJI Mini 2, Mini 3, Mini 3 Pro, Mini 4 Pro, Mini 5 Pro
If your drone is on this list and has not received a firmware update, it is vulnerable to any attacker within Bluetooth range.
What this means for your privacy and data
A drone vulnerability might seem remote from everyday privacy concerns — but the implications are concrete:
- Live video in the wrong hands. After gaining control, an attacker can view the drone camera's live feed in real time.
- GPS coordinates and flight routes exposed. Drones log GPS data and route histories; once connected to the drone's Wi-Fi, an attacker can download this data without the owner's knowledge.
- Risk of physical damage. A forced system reboot or mid-flight disconnection can result in the loss or damage of an expensive device.
- Commercial and professional impact. Construction monitoring, inspection, and emergency operations can be critically disrupted by an unexpected loss of drone control.
This is a clear example of why digital security requires multiple layers. A VPN encrypts your internet traffic and hides your IP, but it does not protect a nearby device's Bluetooth interface. Against CVE-2026-78306, the right defense is a firmware update. Read more about layered security on our blog.
How to protect yourself
DJI has already released updated firmware. Here is a clear action plan:
- Update your firmware via the DJI Fly app or DJI Assistant 2 to the latest version — check for updates now.
- Disable Bluetooth when the drone is not in active use: during transport, storage, or charging.
- Do not leave the drone powered on unattended in public places.
- Monitor DJI's official security advisories on the support page.
- Keep all device firmware up to date: smartphone, router, drone — outdated firmware on any device is a potential attack vector.