High 8.5Published Aug 24, 2026

CVE-2026-78306DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution

Updated under an hour ago (Oct 28, 2026, 7:23 PM ET)

Does this affect you?

It affects DJI Neo and 15 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for DJI Neo

Exploited in the last 30 days

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone's internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator's wireless control, video, and telemetry connections during flight. Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600. Remediation requires a firmware update from the vendor.

CVSS: 8.5 HIGH (v4.0, CNA)CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
Weakness (CWE): CWE-306
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: CIRCL
NVD analysis: Deferred
Record last updated: Oct 12, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

DJI Neo dji:neo (from the name)	through 01.00.0400	CNA record
DJI Neo 2 dji:neo_2 (from the name)	through 01.00.0500	CNA record
DJI Flip dji:flip (from the name)	through 01.00.1200	CNA record
DJI Air 3 dji:air_3 (from the name)	through 01.00.1600	CNA record
DJI Air 3S dji:air_3s (from the name)	through 01.00.1400	CNA record
DJI Avata 2 dji:avata_2 (from the name)	through 01.00.0400	CNA record
DJI Avata 360 dji:avata_360 (from the name)	through 01.00.0300	CNA record
DJI Mavic 3 dji:mavic_3 (from the name)	through 01.00.1400	CNA record
DJI Mavic 3 Classic dji:mavic_3_classic (from the name)	through 01.00.0800	CNA record
DJI Mavic 3 Pro dji:mavic_3_pro (from the name)	through 01.01.0700	CNA record
1–10 of 16

References

References

https://support.dji.com/help/content?customId=en-us03400011149&spaceId=34&re=US&lang=en	product
https://github.com/Wh02m1/CVE-2026-78306	technical-description

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.