CVE-2026-78306: CWE-306 Missing Authentication for Critical Function in DJI Neo

CVE-2026-78306 is a missing authentication vulnerability (CWE-306) in DJI drones' DUML command interface over Bluetooth. The interface is unauthenticated, allowing an attacker within Bluetooth range to send commands that modify Wi-Fi configuration parameters such as SSID, PSK, MAC address, regulatory country code, and wireless channel. By overwriting the Wi-Fi PSK with a known value, an attacker can connect to the drone's internal Wi-Fi network and potentially access the flight control interface to issue commands. Additionally, crafted DUML commands can disable or restart Wi-Fi and Bluetooth interfaces, disconnect clients, or reset wireless configurations, resulting in denial-of-service conditions that disrupt control, video, and telemetry during flight. The affected DJI models include Neo, Neo 2, Flip, Air 3, Air 3S, Avata 2, Avata 360, Mavic 3, Mavic 3 Classic, Mavic 3 Pro, Mavic 4 Pro, Mini 2, Mini 3, Mini 3 Pro, Mini 4 Pro, and Mini 5 Pro, all up to specified firmware versions. A firmware update from DJI is required for remediation.

An attacker within Bluetooth range can modify critical Wi-Fi parameters without authentication, potentially gaining unauthorized access to the drone's internal Wi-Fi network and flight control interface. This can lead to unauthorized flight commands and control. Additionally, attackers can cause denial-of-service by disabling or restarting wireless interfaces or resetting configurations, disrupting the operator's control, video feed, and telemetry during flight. The vulnerability poses a high risk to drone operation security and availability.

Remediation requires applying a firmware update from DJI. No official patch links or advisory details are provided in the input, so users should monitor DJI's official channels for firmware updates addressing this vulnerability. Until patched, affected drones remain vulnerable to unauthenticated Bluetooth attacks within range.