# DJI bluetooth bug to connect and inject commands to take over the flight controller (CVE-2026-78306) **URL:** \ **Category:** Modifications & Firmware Updates\ **Created:** [24 September 2026 05:41 UTC](https://greyarro.ws/t/dji-bluetooth-bug-to-connect-and-inject-commands-to-take-over-the-flight-controller-cve-2026-78306/115880 "2026-09-24T05:41:41Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![PingSpike](https://greyarro.ws/user_avatar/greyarro.ws/pingspike/32/7393_2.png) [@PingSpike](https://greyarro.ws/u/PingSpike)\ **Post date:** [24 September 2026 05:41 UTC](https://greyarro.ws/t/dji-bluetooth-bug-to-connect-and-inject-commands-to-take-over-the-flight-controller-cve-2026-78306/115880/1 "2026-09-24T05:41:41Z")
A new bug has been found in DJI firmware which could allow an attacker within bluetooth range to modify Wi-Fi configuration parameters in order to connect to the drone’s internal Wi-Fi network, enabling or disabling radio interfaces; restarting or powering off the aircraft; resetting the configuration, which wipes all videos and pictures captured by the drone; and performing other actions. Given the relatively poor range and performance of bluetooth the real world risks are probably very low, but one to keep an eye on anyway because someone else rebooting or powering off your drone mid-flight could get interesting 😳 Expect a whole bunch of _“Fixed some known issues”_ firmware updates from DJI soon. * * * List of known affected models and firmware versions so far: | Product | Affected Version | | --- | --- | | DJI Neo | 01.00.0400 | | DJI Neo 2 | 01.00.0500 | | DJI Flip | 01.00.1200 | | DJI Air 3 | 01.00.1600 | | DJI Air 3S | 01.00.1400 | | DJI Avata 2 | 01.00.0400 | | DJI Avata 360 | 01.00.0300 | | DJI Mavic 3 | 01.00.1400 | | DJI Mavic 3 Classic | 01.00.0800 | | DJI Mavic 3 Pro | 01.01.0700 | | DJI Mavic 4 Pro | 01.00.0500 | | DJI Mini 2 | 01.07.0200 | | DJI Mini 3 | 01.00.0500 | | DJI Mini 3 Pro | 01.00.0900 | | DJI Mini 4 Pro | 01.00.1100 | | DJI Mini 5 Pro | 01.00.0600 | * * * Proof of concept fork if you want to test it yourself: > **[GitHub - ping-spike/CVE-2026-78306: DJI Drone DUML Command Injection over Bluetooth —...](https://github.com/ping-spike/CVE-2026-78306)** > > DJI Drone DUML Command Injection over Bluetooth — Proof of Concept for CVE-2026-78306 Main: > **[GitHub - Wh02m1/CVE-2026-78306: DJI Drone DUML Command Injection over Bluetooth —...](https://github.com/Wh02m1/CVE-2026-78306/)** > > DJI Drone DUML Command Injection over Bluetooth — Proof of Concept for CVE-2026-78306 * * * Source: [https://www.cve.org/CVERecord?id=CVE-2026-78306](https://www.cve.org/CVERecord?id=CVE-2026-78306) ---
**Author:** ![PingSpike](https://greyarro.ws/user_avatar/greyarro.ws/pingspike/32/7393_2.png) [@PingSpike](https://greyarro.ws/u/PingSpike)\ **Post date:** [24 September 2026 06:57 UTC](https://greyarro.ws/t/dji-bluetooth-bug-to-connect-and-inject-commands-to-take-over-the-flight-controller-cve-2026-78306/115880/4 "2026-09-24T06:57:17Z")
There’s a video of the hack being demonstrated here: [https://x.com/0xWh0\_4m\_1\_/status/2101787204250943984](https://x.com/0xWh0_4m_1_/status/2101787204250943984) ---
**Author:** ![WoolySheep](https://greyarro.ws/user_avatar/greyarro.ws/woolysheep/32/241330_2.png) [@WoolySheep](https://greyarro.ws/u/WoolySheep)\ **Post date:** [24 September 2026 07:35 UTC](https://greyarro.ws/t/dji-bluetooth-bug-to-connect-and-inject-commands-to-take-over-the-flight-controller-cve-2026-78306/115880/6 "2026-09-24T07:35:40Z")
Scary. As you say though, unless you are flying close to people, it shouldn’t be a major concern for now (until they patch it). ---
**Author:** ![OzoneVibe](https://greyarro.ws/user_avatar/greyarro.ws/ozonevibe/32/12764_2.png) [@OzoneVibe](https://greyarro.ws/u/OzoneVibe)\ **Post date:** [24 September 2026 08:00 UTC](https://greyarro.ws/t/dji-bluetooth-bug-to-connect-and-inject-commands-to-take-over-the-flight-controller-cve-2026-78306/115880/7 "2026-09-24T08:00:48Z")
We missed an excellent chance to test this vulnerability at the BM. Lots of drones in closer proximity … 🤪 😱😱😱 ---
**Author:** ![MDSteve](https://greyarro.ws/letter_avatar_proxy/v4/letter/m/5fc32e/32.png) [@MDSteve](https://greyarro.ws/u/MDSteve)\ **Post date:** [24 September 2026 08:06 UTC](https://greyarro.ws/t/dji-bluetooth-bug-to-connect-and-inject-commands-to-take-over-the-flight-controller-cve-2026-78306/115880/8 "2026-09-24T08:06:57Z")
Surely the short term ‘fix’ is to ensure BT is turned OFF, before any flights? ---
**Author:** ![PingSpike](https://greyarro.ws/user_avatar/greyarro.ws/pingspike/32/7393_2.png) [@PingSpike](https://greyarro.ws/u/PingSpike)\ **Post date:** [24 September 2026 08:08 UTC](https://greyarro.ws/t/dji-bluetooth-bug-to-connect-and-inject-commands-to-take-over-the-flight-controller-cve-2026-78306/115880/9 "2026-09-24T08:08:31Z")
I don’t think you can’t disable the bluetooth radio on the drone itself, Steve? 🤔 ---
**Author:** ![MDSteve](https://greyarro.ws/letter_avatar_proxy/v4/letter/m/5fc32e/32.png) [@MDSteve](https://greyarro.ws/u/MDSteve)\ **Post date:** [24 September 2026 08:13 UTC](https://greyarro.ws/t/dji-bluetooth-bug-to-connect-and-inject-commands-to-take-over-the-flight-controller-cve-2026-78306/115880/10 "2026-09-24T08:13:50Z")
> [@PingSpike](#): > > I don’t think you can’t disable the bluetooth radio on the drone itself, Steve? 🤔 That’s a point, I’ve never tried to turn off the BT on the drone, never gave it a thought. 😱 ---
**Author:** ![Nik469](https://greyarro.ws/letter_avatar_proxy/v4/letter/n/6f9a4e/32.png) [@Nik469](https://greyarro.ws/u/Nik469)\ **Post date:** [24 September 2026 14:20 UTC](https://greyarro.ws/t/dji-bluetooth-bug-to-connect-and-inject-commands-to-take-over-the-flight-controller-cve-2026-78306/115880/11 "2026-09-24T14:20:25Z")
Are those firmwares revisions the only ones vunerable? Seems my 5 is running 01.00.0700 so it should be patched maybe? ---
**Author:** ![PingSpike](https://greyarro.ws/user_avatar/greyarro.ws/pingspike/32/7393_2.png) [@PingSpike](https://greyarro.ws/u/PingSpike)\ **Post date:** [24 September 2026 14:25 UTC](https://greyarro.ws/t/dji-bluetooth-bug-to-connect-and-inject-commands-to-take-over-the-flight-controller-cve-2026-78306/115880/12 "2026-09-24T14:25:46Z")
> [@Nik469](#): > > my 5 is running 01.00.0700 so it should be patched maybe? I wouldn’t bank on it, DJI are so poor with their release notes that we may never know 😔 Their web site still lists 01.00.0600 as being the most recent firmware available from April 2026 🤦🏻 > **[DJI\_Mini\_5\_Pro\_Release\_Notes\_EN.pdf](https://dl.djicdn.com/downloads/DJI_Mini_5_Pro/RN/20260425/DJI_Mini_5_Pro_Release_Notes_EN.pdf)** > > 78.08 KB ---
**Author:** ![Nik469](https://greyarro.ws/letter_avatar_proxy/v4/letter/n/6f9a4e/32.png) [@Nik469](https://greyarro.ws/u/Nik469)\ **Post date:** [24 September 2026 14:35 UTC](https://greyarro.ws/t/dji-bluetooth-bug-to-connect-and-inject-commands-to-take-over-the-flight-controller-cve-2026-78306/115880/13 "2026-09-24T14:35:45Z")
Lol, Figures, 0700 seems to be the latest according to fly. Do any of those affected drones allow for concurrent connections? ---
**Author:** ![axelz](https://greyarro.ws/letter_avatar_proxy/v4/letter/a/c67d28/32.png) [@axelz](https://greyarro.ws/u/axelz)\ **Post date:** [25 September 2026 09:45 UTC](https://greyarro.ws/t/dji-bluetooth-bug-to-connect-and-inject-commands-to-take-over-the-flight-controller-cve-2026-78306/115880/14 "2026-09-25T09:45:53Z")
An interesting development, it did connect up to a DJI neo I have… using a raspberry pi 5.