30.06.2025
2 min
698
A serious Bluetooth vulnerability affecting 16 popular DJI drone models could allow a nearby hacker to disconnect the operator and potentially take control of the drone without authentication.
The issue affects the Mavic and Mini product lines from the Chinese commercial drone manufacturer, as well as the Air 3, Air 3S, Neo, Flip, Avata 2, and Avata 360 models. Security researchers Abdelrahman Youssef and Dr. Jordan Samhi discovered the CVE-2026-78306 vulnerability in the mechanism DJI drones use to authenticate commands received over Bluetooth. The vulnerability received a severity score of 8.5 out of 10, indicating a high level of risk and the need for prompt remediation.
According to the vulnerability description, Bluetooth is used to connect to the drone’s Wi-Fi interface and exchange network data. However, the researchers found that only three commands, retrieving the Wi-Fi network name, password, and MAC address, actually verify the presence of a trusted universally unique identifier (UUID).
Other commands do not perform the same check. This means that anyone within Bluetooth range can send unauthorized instructions using DUML, DJI’s proprietary protocol for communication between the drone and its controller.
The researchers’ proof of concept (PoC) shows that unauthenticated commands can be used to change the Wi-Fi password and network name, modify wireless settings, disable or restart Wi-Fi and Bluetooth, reboot or power off the drone, and reset its configuration.
Some reset commands affect the drone’s system, flight controller, camera gimbal, camera, Wi-Fi, and software-defined radio configuration. Others can format the media storage and erase the device’s system logs.
In their disclaimer, the researchers warn that the PoC may result in “data loss, configuration changes, loss of connectivity, and device disruption.” They stress that the tool should only be used in controlled environments and on systems they are authorized to test.
They also deliberately added an extra confirmation step before executing commands they consider dangerous. For example, one command that resets the system, flight controller, gimbal, camera, Wi-Fi, and software-defined radio configuration displays a warning: “Resetting the flight controller settings may restart the motors.”
An attacker could exploit these flaws to change the drone’s Wi-Fi password, gain access to its internal network, and potentially find a path to the flight control interface. In that case, the attacker could theoretically send control commands to the drone.
However, taking over a drone while it is in flight is only a potential consequence of the vulnerability. The researchers did not demonstrate such a scenario in their proof of concept.
There are currently no reports of this vulnerability being exploited in real-world attacks. It has also not been added to CISA’s Known Exploited Vulnerabilities catalog.
Even if an attacker does not manage to fully take control of a drone, the researchers warn about a possible “loss of connectivity.” This means the connection between the drone and the person operating it could be interrupted or disrupted.
Since drones are now used not only for photography but also for surveying, delivery, and police reconnaissance, such disruptions could have consequences that go far beyond damage to or loss of the aircraft itself.
CVE-2026-78306 was one of several DJI vulnerabilities disclosed by Youssef and Samhi in August.
Among the other issues, the researchers found a media server that did not require authentication, an FTP service that used the same hardcoded credentials across all devices, and another media server flaw that could expose information that should not have been accessible.
Another vulnerability disclosed in August involved DUML data being transmitted over Bluetooth without encryption. As a result, anyone nearby could potentially intercept and read the data.
