DJI bluetooth bug to connect and inject commands to take over the flight controller (CVE-2026-78306)

Modifications & Firmware Updates
1

A new bug has been found in DJI firmware which could allow an attacker within bluetooth range to modify Wi-Fi configuration parameters in order to connect to the drone’s internal Wi-Fi network, enabling or disabling radio interfaces; restarting or powering off the aircraft; resetting the configuration, which wipes all videos and pictures captured by the drone; and performing other actions.

Given the relatively poor range and performance of bluetooth the real world risks are probably very low, but one to keep an eye on anyway because someone else rebooting or powering off your drone mid-flight could get interesting :flushed_face:

Expect a whole bunch of “Fixed some known issues” firmware updates from DJI soon.

List of known affected models and firmware versions so far:

Product Affected Version
DJI Neo 01.00.0400
DJI Neo 2 01.00.0500
DJI Flip 01.00.1200
DJI Air 3 01.00.1600
DJI Air 3S 01.00.1400
DJI Avata 2 01.00.0400
DJI Avata 360 01.00.0300
DJI Mavic 3 01.00.1400
DJI Mavic 3 Classic 01.00.0800
DJI Mavic 3 Pro 01.01.0700
DJI Mavic 4 Pro 01.00.0500
DJI Mini 2 01.07.0200
DJI Mini 3 01.00.0500
DJI Mini 3 Pro 01.00.0900
DJI Mini 4 Pro 01.00.1100
DJI Mini 5 Pro 01.00.0600

Proof of concept fork if you want to test it yourself:

Main:

Source:

https://www.cve.org/CVERecord?id=CVE-2026-78306

2 Likes
4

There’s a video of the hack being demonstrated here:

https://x.com/0xWh0_4m_1_/status/2101787204250943984

1 Like
6

Scary. As you say though, unless you are flying close to people, it shouldn’t be a major concern for now (until they patch it).

2 Likes
7

We missed an excellent chance to test this vulnerability at the BM. Lots of drones in closer proximity … :zany_face:

:scream::scream::scream:

1 Like
8

Surely the short term ‘fix’ is to ensure BT is turned OFF, before any flights?

9

I don’t think you can’t disable the bluetooth radio on the drone itself, Steve? :thinking:

10

That’s a point, I’ve never tried to turn off the BT on the drone, never gave it a thought. :scream:

11

Are those firmwares revisions the only ones vunerable?

Seems my 5 is running 01.00.0700 so it should be patched maybe?

12

I wouldn’t bank on it, DJI are so poor with their release notes that we may never know :pensive_face:

Their web site still lists 01.00.0600 as being the most recent firmware available from April 2026 :person_facepalming:t2:

13

Lol,

Figures, 0700 seems to be the latest according to fly.

Do any of those affected drones allow for concurrent connections?

14

An interesting development, it did connect up to a DJI neo I have… using a raspberry pi 5.

1 Like