CVE-2026-78251: DJI drones unauthenticated storage exhaustion via hardcoded FTP credentials

CVE-2026-78251 · Severity: info · Published 2026-08-27

DJI drone models contain an FTP service with hardcoded credentials that allows attackers to upload unlimited files to critical storage directories. An attacker with network access to the drone can fill storage with malicious files, preventing the aircraft from recording flight logs, telemetry, and firmware updates, which could disable safety features and strand the device.

Technologies: DJI Air 3, DJI Air 3S, DJI Avata 2, DJI Avata 360, DJI Flip, DJI Mavic 3, DJI Mavic 3 Classic, DJI Mavic 3 Pro, DJI Mavic 4 Pro, DJI Mini 2, DJI Mini 3, DJI Mini 3 Pro, DJI Mini 4 Pro, DJI Mini 5 Pro, DJI Neo, DJI Neo 2. Vendors: DJI.

Quick answers

Is CVE-2026-78251 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-78251 being exploited in the wild.
How severe is CVE-2026-78251?
Informational severity, published 27 August 2026.
Which products and versions are affected?
DJI Air 3 before 01.00.1600; DJI Air 3S before 01.00.1400; DJI Avata 2 before 01.00.0400; DJI Avata 360 before 01.00.0300; and 12 more.
Is there a fix for CVE-2026-78251?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-78251 attacked?
It is attacked over the network or from the adjacent network, in device firmware.
Am I affected by CVE-2026-78251?
Check whether you run DJI Air 3, DJI Air 3S, DJI Avata 2 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a hardcoded credential and unrestricted file upload issue in the FTP service present on multiple DJI drone models. Attackers who gain access to the drone's internal network or USB RNDIS interface can use static credentials to authenticate to the FTP service and upload files of any size to the /blackbox/upgrade/ directory without restrictions on file count or total storage consumption. The attack allows overwriting existing files and persists across reboot and factory reset, enabling denial-of-service attacks that prevent flight logging, telemetry recording, and firmware updates. Vendor remediation requires a firmware update to all affected models.

Affected products

  • DJI Neo before 01.00.0400
  • DJI Neo 2 before 01.00.0500
  • DJI Flip before 01.00.1200
  • DJI Air 3 before 01.00.1600
  • DJI Air 3S before 01.00.1400
  • DJI Avata 2 before 01.00.0400
  • DJI Avata 360 before 01.00.0300
  • DJI Mavic 3 before 01.00.1400
  • DJI Mavic 3 Classic before 01.00.0800
  • DJI Mavic 3 Pro before 01.01.0700
  • DJI Mavic 4 Pro before 01.00.0500
  • DJI Mini 2 before 01.07.0200
  • DJI Mini 3 before 01.00.0500
  • DJI Mini 3 Pro before 01.00.0900
  • DJI Mini 4 Pro before 01.00.1100
  • DJI Mini 5 Pro before 01.00.0600

Timeline

  • 2026-08-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.