CVE-2026-77812 in Air 3
Summary
by MITRE • 08/21/2026
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.
* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network * The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices. * The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely * The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed * A BLE sniffer and presence during one normal DJI Fly connection are needed
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/21/2026
The identified vulnerability represents a critical failure in wireless communication security within DJI drone ecosystems, specifically affecting the Bluetooth Low Energy interface used for initial device pairing and configuration. The core technical flaw lies in the transmission of DUML protocol messages over BLE without implementing any form of encryption or integrity protection during the exchange of sensitive network credentials. When an operator initiates a connection via the DJI Fly application to establish Wi-Fi communication with the drone, either through standard Wi-Fi linking or by activating QuickTransfer mode, the application transmits the SSID and Pre-Shared Key in cleartext over the BLE channel. This design choice exposes fundamental weaknesses in the authentication handshake process, allowing any adversary within physical radio range of the device to passively intercept these transmissions using a standard Bluetooth sniffer without needing to establish an active connection or transmit any data themselves.
From a threat modeling perspective, this vulnerability aligns closely with CWE-319, which describes cleartext transmission of sensitive information over a communication channel that is not protected against eavesdropping. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic T1046, Network Service Discovery, and specifically sub-tactic techniques involving passive network sniffing such as ARP Poisoning or general wireless traffic interception depending on the specific layer exploited. The attacker does not need to compromise the drone’s operating system or exploit a software bug in the traditional sense; rather, they leverage the inherent lack of confidentiality controls in the BLE protocol implementation during credential exchange. This allows for a fully passive attack vector where the legitimate user and the device remain unaware that their session is being observed, as no packets are injected into the network to trigger alerts or anomalies.
The operational impact of this vulnerability extends beyond simple credential theft. By capturing the Wi-Fi PSK and SSID in cleartext, an attacker gains immediate access to join the drone’s internal local area network. Once connected, the adversary can interact with various network services exposed by the drone’s embedded systems, potentially leading to unauthorized control or data exfiltration. More critically, the capture also reveals a session UUID identifier that serves as the sole mechanism for distinguishing trusted clients from unknown devices during subsequent connections. Possession of this static identifier allows an attacker to replay it in future pairing attempts, effectively bypassing physical confirmation requirements and enabling persistent access without needing repeated credential captures. Because these credentials remain constant across sessions unless manually reset by the operator, a single successful capture provides indefinite access rights, significantly amplifying the long-term risk profile for affected users who may not frequently change their network settings.
The scope of this vulnerability is extensive, impacting numerous popular consumer and professional drone models including the DJI Neo series up to specific firmware versions, as well as the Air 3, Avata 2, Mavic 3 family, Mini 4 Pro, and others listed in the advisory. The lack of user-side mitigations means that operators cannot configure their devices or networks to prevent this leakage; the flaw is embedded in the firmware’s handling of BLE communications. Consequently, remediation relies entirely on vendor-provided updates that implement proper encryption for DUML messages over BLE and rotate session identifiers dynamically to prevent replay attacks. Until such firmware patches are applied and installed by end-users, these devices remain susceptible to passive eavesdropping attacks that compromise both network confidentiality and device authentication integrity.