This vulnerability (CWE-306) involves missing authentication on the HTTP media server of DJI drones, allowing unauthenticated clients on the drone's internal network to access stored photos and videos via the `/v2` endpoint. Filenames follow a predictable pattern, enabling enumeration and exfiltration of media files. The flaw affects multiple DJI drone models with firmware versions up to specified limits, exposing potentially sensitive user data without requiring any privileges or user interaction.

An attacker who gains access to the drone's internal network can retrieve stored media files without authentication. This exposure can lead to privacy breaches by revealing sensitive information such as private locations, property details, travel history, identifiable individuals, and operator routines. There is no indication of remote exploitation outside the internal network or privilege requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the drone's internal network to trusted users only to prevent unauthorized enumeration and exfiltration of media files.