CVE-2026-78306 in Air 3
Summary
by MITRE • 08/24/2026
DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone's internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator's wireless control, video, and telemetry connections during flight.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability in question represents a critical security flaw within the wireless communication subsystem of various DJI drone models, specifically affecting devices running firmware versions prior to those listed as remediated. The core issue stems from an unauthenticated command interface known as DUML that is exposed over Bluetooth Low Energy connections. This architectural oversight allows any attacker positioned within standard Bluetooth range to interact directly with the drone's internal configuration systems without requiring valid credentials or pairing authorization. By exploiting this lack of authentication, a malicious actor can send crafted commands to modify essential Wi-Fi parameters such as the Service Set Identifier, Pre-Shared Key for network access control, MAC address, regulatory country code, and wireless channel selection. This capability fundamentally undermines the security boundary between the drone's local management interface and external entities, creating a pathway for unauthorized configuration changes that persist until manually reset or overridden by subsequent commands.
The operational impact of this vulnerability is severe due to its direct influence on flight control capabilities and network integrity. An attacker who successfully modifies the Wi-Fi Pre-Shared Key can overwrite it with a known value, thereby gaining access to the drone's internal Wi-Fi network. Once connected, the attacker may intercept sensitive telemetry data or, more critically, issue unauthorized flight commands through the exposed flight control interface. This scenario poses an immediate physical safety risk, as malicious actors could potentially hijack the aircraft during operation, leading to loss of vehicle control, collisions with obstacles or persons, and significant property damage beyond just the drone itself. Furthermore, the ability to alter regulatory settings such as country codes and wireless channels can lead to non-compliance with local telecommunications laws and interference with other electronic devices in the vicinity.
In addition to unauthorized access and potential hijacking, this vulnerability enables sophisticated denial-of-service attacks that disrupt normal operational functions. Crafted DUML commands allow an attacker to disable or restart both Wi-Fi and Bluetooth interfaces remotely. This action effectively severs the connection between the drone and its operator's controller, cutting off live video feeds, telemetry data streams, and command inputs mid-flight. Such disruptions are particularly dangerous during critical phases of flight where maintaining visual contact and real-time control is essential for safe navigation. The ability to disconnect Wi-Fi clients further isolates the device from any connected peripherals or mobile applications that rely on stable network connectivity for extended functionality. These actions collectively degrade the reliability and safety of the drone system, turning a consumer-grade aerial vehicle into an unstable platform susceptible to remote interference.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to verify identity before allowing configuration changes. It also relates to CWE-693 Protection Mechanism Failure due to the exposure of administrative interfaces over insecure channels like Bluetooth without adequate access controls. In terms of offensive security frameworks, these actions map closely to MITRE ATT&CK techniques involving Local Network Takeover and Peripheral Device Control, where an adversary leverages physical proximity to compromise device settings and potentially escalate privileges within the local network environment. The exploitation does not require complex remote code execution but rather simple command injection over a short-range wireless protocol, making it accessible to attackers with basic technical knowledge of Bluetooth packet crafting tools.
Remediation for this issue is strictly dependent on vendor-provided updates. Operators must ensure their drone firmware is updated to the specific versions designated as secure by DJI, which vary by model series including the Neo, Flip, Air 3, Avata, Mavic, and Mini lines. Until such patches are applied, users should remain aware of the physical risks associated with operating drones in crowded or unsecured environments where unauthorized individuals might attempt to exploit this Bluetooth-based interface. Implementing strict operational protocols that discourage leaving devices powered on and discoverable for extended periods can mitigate exposure windows, though firmware updates remain the only definitive solution to close these architectural gaps in wireless security design.