CVE-2026-1743

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1743", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-01T16:35:47.330Z", "datePublished": "2026-02-02T04:02:07.053Z", "dateUpdated": "2026-02-23T09:13:47.578Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:13:47.578Z"}, "title": "DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-294", "lang": "en", "description": "Authentication Bypass by Capture-replay"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "Improper Authentication"}]}], "affected": [{"vendor": "DJI", "product": "Mavic Mini", "versions": [{"version": "01.00", "status": "affected"}], "modules": ["Enhanced Wi-Fi Pairing"]}, {"vendor": "DJI", "product": "Air", "versions": [{"version": "01.00", "status": "affected"}], "modules": ["Enhanced Wi-Fi Pairing"]}, {"vendor": "DJI", "product": "Spark", "versions": [{"version": "01.00", "status": "affected"}], "modules": ["Enhanced Wi-Fi Pairing"]}, {"vendor": "DJI", "product": "Mini SE", "versions": [{"version": "01.00", "status": "affected"}], "modules": ["Enhanced Wi-Fi Pairing"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in DJI Mavic Mini, Air, Spark and Mini SE up to 01.00.0500. Affected by this vulnerability is an unknown functionality of the component Enhanced Wi-Fi Pairing. The manipulation leads to authentication bypass by capture-replay. The attack must be carried out from within the local network. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.1, "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.8, "vectorString": "AV:A/AC:H/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-01T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-01T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-02T08:28:17.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "byteme1001 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "byteme1001 (VulDB User)", "type": "analyst"}], "references": [{"url": "https://vuldb.com/?id.343674", "name": "VDB-343674 | DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.343674", "name": "VDB-343674 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.741323", "name": "Submit #741323 | DJI DJI Mavic Mini, Spark, Mini SE 01.00.0500 and Below Authentication Bypass by Capture-replay", "tags": ["third-party-advisory"]}, {"url": "https://github.com/ByteMe1001/DJI-CatNect", "tags": ["related"]}, {"url": "https://github.com/ByteMe1001/DJI-CatNect/blob/main/exploit.c", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-03T14:32:25.302924Z", "id": "CVE-2026-1743", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T15:32:46.738Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1743", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-03T14:32:25.302924Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T14:32:33.991Z"}}], "cna": {"title": "DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay", "credits": [{"lang": "en", "type": "reporter", "value": "byteme1001 (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "byteme1001 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.8, "vectorString": "AV:A/AC:H/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "DJI", "modules": ["Enhanced Wi-Fi Pairing"], "product": "Mavic Mini", "versions": [{"status": "affected", "version": "01.00"}]}, {"vendor": "DJI", "modules": ["Enhanced Wi-Fi Pairing"], "product": "Air", "versions": [{"status": "affected", "version": "01.00"}]}, {"vendor": "DJI", "modules": ["Enhanced Wi-Fi Pairing"], "product": "Spark", "versions": [{"status": "affected", "version": "01.00"}]}, {"vendor": "DJI", "modules": ["Enhanced Wi-Fi Pairing"], "product": "Mini SE", "versions": [{"status": "affected", "version": "01.00"}]}], "timeline": [{"lang": "en", "time": "2026-02-01T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-01T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-02T08:28:17.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.343674", "name": "VDB-343674 | DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.343674", "name": "VDB-343674 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.741323", "name": "Submit #741323 | DJI DJI Mavic Mini, Spark, Mini SE 01.00.0500 and Below Authentication Bypass by Capture-replay", "tags": ["third-party-advisory"]}, {"url": "https://github.com/ByteMe1001/DJI-CatNect", "tags": ["related"]}, {"url": "https://github.com/ByteMe1001/DJI-CatNect/blob/main/exploit.c", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in DJI Mavic Mini, Air, Spark and Mini SE up to 01.00.0500. Affected by this vulnerability is an unknown functionality of the component Enhanced Wi-Fi Pairing. The manipulation leads to authentication bypass by capture-replay. The attack must be carried out from within the local network. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-294", "description": "Authentication Bypass by Capture-replay"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "Improper Authentication"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:13:47.578Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1743", "state": "PUBLISHED", "dateUpdated": "2026-02-23T09:13:47.578Z", "dateReserved": "2026-02-01T16:35:47.330Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-02T04:02:07.053Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Enhanced Wi-Fi Pairing"], "product": "Mavic Mini", "vendor": "DJI", "versions": [{"status": "affected", "version": "01.00"}]}, {"modules": ["Enhanced Wi-Fi Pairing"], "product": "Air", "vendor": "DJI", "versions": [{"status": "affected", "version": "01.00"}]}, {"modules": ["Enhanced Wi-Fi Pairing"], "product": "Spark", "vendor": "DJI", "versions": [{"status": "affected", "version": "01.00"}]}, {"modules": ["Enhanced Wi-Fi Pairing"], "product": "Mini SE", "vendor": "DJI", "versions": [{"status": "affected", "version": "01.00"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in DJI Mavic Mini, Air, Spark and Mini SE up to 01.00.0500. Affected by this vulnerability is an unknown functionality of the component Enhanced Wi-Fi Pairing. The manipulation leads to authentication bypass by capture-replay. The attack must be carried out from within the local network. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en DJI Mavic Mini, Air, Spark y Mini SE hasta 01.00.0500. Afectada por esta vulnerabilidad es una funcionalidad desconocida del componente Enhanced Wi-Fi Pairing. La manipulaci\u00f3n conduce a una omisi\u00f3n de autenticaci\u00f3n mediante captura-repetici\u00f3n. El ataque debe llevarse a cabo desde dentro de la red local. Un alto grado de complejidad es necesario para el ataque. La explotaci\u00f3n parece ser dif\u00edcil. El exploit ha sido revelado al p\u00fablico y puede ser utilizado. El proveedor fue contactado con antelaci\u00f3n sobre esta revelaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-1743", "lastModified": "2026-06-17T10:16:26.377", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 1.8, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:A/AC:H/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 3.2, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1743", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-03T14:32:25.302924Z", "version": "2.0.3"}}]}, "published": "2026-02-02T04:15:55.547", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/ByteMe1001/DJI-CatNect"}, {"source": "cna@vuldb.com", "url": "https://github.com/ByteMe1001/DJI-CatNect/blob/main/exploit.c"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.343674"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.343674"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.741323"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-294"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:47:09.023369+00:00", "value": {"mitigation_remediation": ["Check the DJI website or vendor support for firmware updates that address Enhanced Wi\u2011Fi Pairing; apply such a patch as soon as it becomes available.", "If no patch exists, disable or limit the Enhanced Wi\u2011Fi Pairing feature in the drone\u2019s configuration, or block the relevant Wi\u2011Fi channels on the local network to prevent the capture of authentication traffic.", "Segment the drone\u2019s local network from other corporate or home networks by placing it on a separate VLAN or subnet and enforce strict firewall rules to restrict access to the device\u2019s control ports."], "summary": {"action": "Assess", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "Affected products include DJI Air, DJI Mavic Mini, DJI Mini SE, and DJI Spark. Firmware versions up to 01.00.0500 are susceptible. No patch or firmware update is currently available from DJI; the vendor has not responded to the public disclosure.", "description_and_impact": "A vulnerability exists in the Enhanced Wi\u2011Fi Pairing function of DJI Mavic Mini, Air, Spark and Mini SE drones. By capturing and replaying a valid authentication sequence, an attacker can cause the drone to accept the replay and thereby bypass the authentication required for pairing. The vulnerability permits unauthorized local\u2010network access to the drone\u2019s control interface, potentially allowing control over the device without proper credentials. Only the authentication step is compromised; other local\u2011level controls remain intact, but the ability to pair without credentials can lead to unauthorized flight or data manipulation.", "risk_and_exploitability": "The CVSS score of 2.3 indicates low overall severity, and the EPSS score of less than 1\u202f% suggests that the likelihood of exploitation in the wild is very small. However, exploitation requires the attacker to be on the same local network and conduct a capture\u2011replay of authentication packets, a process that is complex and potentially difficult. The vulnerability is not listed in CISA\u2019s KEV catalog. If an attacker succeeds, they can achieve unauthorized local pairing, which may facilitate further actions such as remote control or data exfiltration, but the attack is limited to the local network scope."}}}}, "created": "2026-02-02T09:26:11.778003+00:00", "updated": "2026-04-18T01:00:11.618650+00:00", "vendors": ["dji", "dji$PRODUCT$mini", "dji$PRODUCT$mini_se", "dji$PRODUCT$spark"]}