CVE-2026-78306 describes a missing authentication vulnerability (CWE-306) in the DUML command interface exposed over Bluetooth on various DJI drone models. This interface allows unauthenticated attackers within Bluetooth range to modify Wi-Fi configuration parameters such as SSID, PSK, MAC address, regulatory country code, and wireless channel. By overwriting the Wi-Fi PSK with a known value, attackers can connect to the drone's internal Wi-Fi network and potentially access the flight control interface to issue commands. Crafted DUML commands can also disable or restart Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configurations, causing denial-of-service conditions that disrupt control, video, and telemetry during flight. Affected models include DJI Neo, Neo 2, Flip, Air 3, Air 3S, Avata 2, Avata 360, Mavic 3 series, Mini 2, Mini 3 series, Mini 4 Pro, and Mini 5 Pro up to specified firmware versions. Remediation requires a firmware update from DJI.

An attacker within Bluetooth range can gain unauthorized access to the drone's Wi-Fi network by modifying Wi-Fi credentials, potentially allowing control over flight commands. The attacker can also cause denial-of-service by disabling or restarting wireless interfaces, disrupting the operator's control and telemetry during flight. This poses a high risk to drone operation security and safety.

Remediation requires applying a firmware update from DJI. No official patch details or temporary mitigations are provided in the available data. Users should monitor DJI advisories for firmware updates addressing this vulnerability.