CVE-2026-78255: CWE-306 Missing Authentication for Critical Function in DJI Neo

The vulnerability (CWE-306) in DJI drones involves missing authentication on the HTTP media server's /v2 endpoint, which serves stored photos and videos. Because filenames follow a predictable pattern and no authentication is required, an attacker connected to the drone's internal network can enumerate and exfiltrate media files. This exposure risks leaking sensitive information such as operator routines and private locations. Affected models include DJI Neo, Neo 2, Flip, Air 3, Air 3S, Avata 2, Avata 360, Mavic 3 series, Mini 2, Mini 3 series, Mini 4 Pro, and Mini 5 Pro, each up to specific firmware versions listed in the affectedVersions field. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker on the drone's internal network can access and exfiltrate stored photos and videos, potentially exposing sensitive personal and operational information. This could lead to privacy violations and intelligence gathering on the drone operator's activities. The CVSS 4.0 score of 8.7 reflects high severity due to network attack vector, no required privileges or user interaction, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the drone's internal network to trusted users only to prevent unauthorized enumeration and exfiltration of media files.