CVE-2026-77812Critical· 9.4▾ AbyssalPoC available

DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score64/ 100 · Elevated

impact 51.7 · likelihood 0 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Aug 21, 2026

Updated

Oct 15, 2026

CVSS

9.4

Vendor

DJI

Product

Neo

CWE

CWE-311

Depth score

64 · Elevated

EPSS

0.09% · p0

Platforms

—

Source

NVD

Vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-27

GitHub PoCs

1 public repository

Wh02m1/CVE-2026-77812 ↗

CISA SSVC

decided 2026-08-21

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 12.

0.09% → 0.09%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

7 events · 68 days

Aug 21, 2026Published
Disclosed via NVD
Oct 12, 2026EPSS first tracked
0.09%
Oct 14, 2026EPSS peak
0.09% → 0.09%
Oct 15, 2026Record revised
Last analysed / modified upstream
Oct 15, 2026CVSS changed
— → 9.4
Oct 15, 2026Severity changed
none → critical
Oct 27, 2026Public exploit observed
1 GitHub repo (last check)

DJI CWE-311 #nvd #exploit-available #cve.org

Affected

Neo <= 01.00.0400
neo_2 <= 01.00.0500
flip <= 01.00.1200
air_3 <= 01.00.1600
air_3s <= 01.00.1400
avata_2 <= 01.00.0400
avata_360 <= 01.00.0300
mavic_3 <= 01.00.1400
mavic_3_classic <= 01.00.0800
mavic_3_pro <= 01.01.0700
mavic_4_pro <= 01.00.0500
mini_2 <= 01.07.0200
mini_3 <= 01.00.0500
mini_3_pro <= 01.00.0900
mini_4_pro <= 01.00.1100
mini_5_pro <= 01.00.0600

Full technical detail▾

Overview

DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.

An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network
The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.
The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely
The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed
A BLE sniffer and presence during one normal DJI Fly connection are needed

Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.

Remediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Change history

Field changes observed since this record was first indexed.

Oct 15, 2026CVSS — → 9.4
Oct 15, 2026Severity none → critical

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available#cve.org

DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score64/ 100 · Elevated

impact 51.7 · likelihood 0 · exploitation 12

Overview

An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network

The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.

The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely

The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed

A BLE sniffer and presence during one normal DJI Fly connection are needed

Remediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading.