CVE-2026-1743 identifies a security vulnerability in DJI drones including the Mavic Mini, Air, Spark, and Mini SE models running firmware up to version 01.00.0500. The vulnerability resides in the Enhanced Wi-Fi Pairing feature, which is responsible for establishing secure connections between the drone and its controller or other devices. The flaw allows an attacker to perform an authentication bypass through a capture-replay attack, where previously captured authentication data packets are replayed to gain unauthorized access. This attack requires the adversary to be present on the same local network as the drone, such as a shared Wi-Fi environment. The complexity of the attack is high due to the need to capture and accurately replay packets without triggering security mechanisms, and no user interaction or privileges are necessary. The vendor DJI was notified early but has not issued any patches or official response. The vulnerability has been publicly disclosed, increasing the risk of potential exploitation despite the current lack of known active exploits. The CVSS 4.0 base score is 2.3, indicating low severity primarily due to the attack complexity, limited attack vector (local network only), and minimal impact on confidentiality, integrity, and availability. This vulnerability could allow unauthorized control or data access on affected drones if exploited, potentially compromising drone operations or sensitive data transmitted during pairing.

The primary impact of this vulnerability is unauthorized access to the drone's pairing process, which could lead to control or data interception during the Wi-Fi pairing phase. For organizations relying on DJI drones for critical operations such as surveying, inspection, or security, this could result in operational disruption or leakage of sensitive information. However, the requirement for local network access and the high complexity of the attack significantly limit the scope and likelihood of exploitation. The absence of known exploits in the wild further reduces immediate risk. Nonetheless, in environments where adversaries can gain local network access—such as corporate campuses, event venues, or restricted areas—this vulnerability could be leveraged to bypass authentication controls. The lack of vendor response and patches means the risk remains unmitigated, potentially exposing users to future attacks as exploit techniques evolve. Overall, the impact is low but non-negligible for high-security contexts.

To mitigate this vulnerability, organizations should implement strict network segmentation and access controls to prevent unauthorized devices from joining local networks where DJI drones operate. Use dedicated, isolated Wi-Fi networks for drone operations to minimize exposure. Monitor network traffic for unusual capture-replay patterns or repeated authentication attempts. Employ physical security measures to restrict proximity access to drones and their controllers. Until DJI releases a firmware update addressing this issue, avoid using affected firmware versions in sensitive environments. Consider disabling Enhanced Wi-Fi Pairing if possible or using alternative secure pairing methods. Regularly audit drone firmware versions and update promptly once patches become available. Additionally, educate drone operators about the risks of connecting to untrusted networks and the importance of operational security.