# CVE-2026-78306: DJI drones Bluetooth unauthenticated DUML command injection

Source: https://junglewise.ai/threats/cve-2026-78306-dji-drones-bluetooth-unauthenticated-duml-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78306 · Severity: info · CVSS 8.1 · Published 2026-08-24

DJI consumer drones expose an unauthenticated Bluetooth interface that allows an attacker within wireless range to modify the drone's Wi-Fi settings, including network credentials and wireless channels. An attacker can hijack the drone's control network, take over flight operations, or deliberately disrupt the operator's connection to the aircraft during flight, creating a safety hazard.

Technologies: [DJI Air 3](https://junglewise.ai/threats/technologies/air-3), [DJI Air 3S](https://junglewise.ai/threats/technologies/air-3s), [DJI Avata 2](https://junglewise.ai/threats/technologies/avata-2), [DJI Avata 360](https://junglewise.ai/threats/technologies/avata-360), [DJI Flip](https://junglewise.ai/threats/technologies/flip), [DJI Mavic 3](https://junglewise.ai/threats/technologies/mavic-3), [DJI Mavic 3 Classic](https://junglewise.ai/threats/technologies/mavic-3-classic), [DJI Mavic 3 Pro](https://junglewise.ai/threats/technologies/mavic-3-pro), [DJI Mavic 4 Pro](https://junglewise.ai/threats/technologies/mavic-4-pro), [DJI Mini 2](https://junglewise.ai/threats/technologies/mini-2), [DJI Mini 3](https://junglewise.ai/threats/technologies/mini-3), [DJI Mini 3 Pro](https://junglewise.ai/threats/technologies/mini-3-pro), [DJI Mini 4 Pro](https://junglewise.ai/threats/technologies/mini-4-pro), [DJI Mini 5 Pro](https://junglewise.ai/threats/technologies/mini-5-pro), [DJI Neo](https://junglewise.ai/threats/technologies/neo), [DJI Neo 2](https://junglewise.ai/threats/technologies/neo-2). Vendors: [DJI](https://junglewise.ai/threats/vendors/dji).

## Quick answers

**Is CVE-2026-78306 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78306 being exploited in the wild.

**How severe is CVE-2026-78306?** Informational severity, with a CVSS score of 8.1, published 24 August 2026.

**Which products and versions are affected?** DJI Air 3 before 01.00.1600; DJI Air 3S before 01.00.1400; DJI Avata 2 before 01.00.0400; DJI Avata 360 before 01.00.0300; and 12 more.

**Is there a fix for CVE-2026-78306?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78306 attacked?** It is attacked from the adjacent network, in device firmware.

**Am I affected by CVE-2026-78306?** Check whether you run DJI Air 3, DJI Air 3S, DJI Avata 2 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unauthenticated command injection in the DUML (DJI Universal Motorcycle Language) protocol over Bluetooth. The Bluetooth interface accepts crafted DUML commands without authentication, allowing an adjacent attacker to modify Wi-Fi SSID, PSK, MAC address, regulatory country, and channel settings. An attacker can overwrite the Wi-Fi pre-shared key with a known value to join the drone's internal control network and issue flight commands, or send crafted commands to disable/restart wireless interfaces, causing denial of service. Remediation requires firmware updates, which are available from DJI for affected models.

## Affected products

- DJI Neo before 01.00.0400
- DJI Neo 2 before 01.00.0500
- DJI Flip before 01.00.1200
- DJI Air 3 before 01.00.1600
- DJI Air 3S before 01.00.1400
- DJI Avata 2 before 01.00.0400
- DJI Avata 360 before 01.00.0300
- DJI Mavic 3 before 01.00.1400
- DJI Mavic 3 Classic before 01.00.0800
- DJI Mavic 3 Pro before 01.01.0700
- DJI Mavic 4 Pro before 01.00.0500
- DJI Mini 2 before 01.07.0200
- DJI Mini 3 before 01.00.0500
- DJI Mini 3 Pro before 01.00.0900
- DJI Mini 4 Pro before 01.00.1100
- DJI Mini 5 Pro before 01.00.0600

## Timeline

- 2026-08-24: disclosed

## References

- [https://support.dji.com/help/content?customId=en-us03400011149&spaceId=34&re=US&lang=en](https://support.dji.com/help/content?customId=en-us03400011149&spaceId=34&re=US&lang=en)

## Related threats

- [DJI drones unauthenticated storage exhaustion via hardcoded FTP credentials](https://junglewise.ai/threats/cve-2026-78251-dji-drones-unauthenticated-storage-exhaustion-via-hardcoded-ftp)
- [DJI drone HTTP media server denial of service via connection exhaustion](https://junglewise.ai/threats/cve-2026-78321-dji-drone-http-media-server-denial-of-service-via-connection)
- [DJI drones HTTP media server unauthenticated photo and video access](https://junglewise.ai/threats/cve-2026-78255-dji-drones-http-media-server-unauthenticated-photo-and-video)
- [DJI drones unencrypted DUML protocol messages over Bluetooth LE](https://junglewise.ai/threats/cve-2026-77812-dji-drones-unencrypted-duml-protocol-messages-over-bluetooth-le)