CVE-2026-77812
Full vulnerability record from the local CVENow database.
Description
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user. * An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network * The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices. * The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely * The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed * A BLE sniffer and presence during one normal DJI Fly connection are needed Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600. Remediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading.
Severity
CRITICAL
CVSS score
9.4
(v4.0)
Vulnerability status
Deferred
Source identifier
5a6e4751-2f3f-4070-9419-94fb35b644e8
Published
2026-08-21 15:16:47.557000
Last modified
2026-11-06 12:17:22.050000
View original CVE JSON
{
"id": "CVE-2026-77812",
"sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"published": "2026-08-21T15:16:47.557",
"lastModified": "2026-11-06T12:17:22.050",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.\n\n* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network \n* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.\n* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely\n* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed\n* A BLE sniffer and presence during one normal DJI Fly connection are needed\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\nRemediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading."
},
{
"lang": "es",
"value": "Los drones DJI transmiten mensajes del protocolo DUML (DJI Universal Markup Language) a través de BLE (Bluetooth Low Energy) sin cifrado. Cuando un cliente intenta conectarse al drone a través de Wi-Fi, o cuando el drone se cambia al modo QuickTransfer, la aplicación DJI Fly intercambia mensajes DUML con el drone a través de BLE, incluyendo las credenciales de Wi-Fi. Un atacante dentro del alcance de BLE puede esnifar pasivamente este tráfico y recuperar las credenciales en texto claro, incluyendo el PSK, SSID y el UUID de identificador de confianza del Wi-Fi del drone. La obtención de estas credenciales permite al atacante unirse a la red Wi-Fi interna del drone, interactuar con los servicios de red expuestos por el drone, y descifrar el tráfico Wi-Fi intercambiado entre el drone y el usuario legítimo.\n\n* Un atacante dentro del alcance de BLE recupera el SSID y el PSK del Wi-Fi en texto claro, y luego puede unirse a la red del drone.\n* La misma captura también expone el identificador UUID de la sesión, que es lo único que el drone utiliza para distinguir un cliente de confianza de uno desconocido, por lo que el atacante puede reproducirlo y omitir la confirmación física de nuevos dispositivos conectados.\n* Las credenciales no cambian entre sesiones a menos que el operador reinicie manualmente la configuración de Wi-Fi, por lo que una captura permanece válida indefinidamente.\n* El ataque es completamente pasivo, sin que se transmita nada y sin que se establezca ninguna conexión, por lo que ni el operador ni el drone tienen ninguna indicación de que la sesión fue observada.\n* Se necesita un sniffer de BLE y presencia durante una conexión normal de DJI Fly.\n\nLos modelos afectados son DJI Neo hasta 01.00.0400, DJI Neo 2 hasta 01.00.0500, DJI Flip hasta 01.00.1200, DJI Air 3 hasta 01.00.1600, DJI Air 3S hasta 01.00.1400, DJI Avata 2 hasta 01.00.0400, DJI Avata 360 hasta 01.00.0300, DJI Mavic 3 hasta 01.00.1400, DJI Mavic 3 Classic hasta 01.00.0800, DJI Mavic 3 Pro hasta 01.01.0700, DJI Mavic 4 Pro hasta 01.00.0500, DJI Mini 2 hasta 01.07.0200, DJI Mini 3 hasta 01.00.0500, DJI Mini 3 Pro hasta 01.00.0900, DJI Mini 4 Pro hasta 01.00.1100, y DJI Mini 5 Pro hasta 01.00.0600.\n\nLa remediación requiere una actualización de firmware del proveedor. No existe una mitigación por parte del usuario que aborde completamente la vulnerabilidad sin actualizar."
}
],
"affected": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"affectedData": [
{
"vendor": "DJI",
"product": "Neo",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "01.00.0400",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "DJI",
"product": "Neo 2",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "01.00.0500",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "DJI",
"product": "DJI Flip",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "01.00.1200",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "DJI",
"product": "Air 3",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "01.00.1600",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "DJI",
"product": "Air 3S",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "01.00.1400",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "DJI",
"product": "Avata 2",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "01.00.0400",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "DJI",
"product": "Avata 360",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "01.00.0300",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "DJI",
"product": "Mavic 3",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "01.00.1400",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "DJI",
"product": "Mavic 3 Classic",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "01.00.0800",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "DJI",
"product": "Mavic 3 Pro",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "01.01.0700",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "DJI",
"product": "Mavic 4 Pro",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "01.00.0500",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "DJI",
"product": "Mini 2",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "01.07.0200",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "DJI",
"product": "Mini 3",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "01.00.0500",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "DJI",
"product": "Mini 3 Pro",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "01.00.0900",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "DJI",
"product": "Mini 4 Pro",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "01.00.1100",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "DJI",
"product": "Mini 5 Pro",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "01.00.0600",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-21T17:42:02.404909Z",
"id": "CVE-2026-77812",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-311"
}
]
}
],
"references": [
{
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-77812/",
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
},
{
"url": "https://github.com/Wh02m1/CVE-2026-77812",
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
},
{
"url": "https://support.dji.com/help/content?customId=en-us03400011149&spaceId=34&re=US&lang=en",
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
}
]
}