CVE-2026-26673

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-26673", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-04T17:25:13.915Z", "dateReserved": "2026-02-16T00:00:00.000Z", "datePublished": "2026-03-04T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-04T15:33:23.989Z"}, "descriptions": [{"lang": "en", "value": "An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via the DJI Enhanced-WiFi transmission subsystem"}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/ByteMe1001/DJI-CatNect"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T17:24:06.123793Z", "id": "CVE-2026-26673", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T17:25:13.915Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-26673", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T17:24:06.123793Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T17:24:38.729Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/ByteMe1001/DJI-CatNect"}], "descriptions": [{"lang": "en", "value": "An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via the DJI Enhanced-WiFi transmission subsystem"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-04T15:33:23.989Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26673", "state": "PUBLISHED", "dateUpdated": "2026-03-04T17:25:13.915Z", "dateReserved": "2026-02-16T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-04T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dji:mavic_mini_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3890F836-3A05-4B4E-8F19-D0AE6550ACE2", "versionEndIncluding": "01.00.0600", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dji:mavic_mini:-:*:*:*:*:*:*:*", "matchCriteriaId": "08B39DB8-A012-40C7-91FD-2D68670F15FC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dji:spark_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "31348F31-A351-4E0C-B53A-CB677588CB59", "versionEndIncluding": "01.00.1000", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dji:spark:-:*:*:*:*:*:*:*", "matchCriteriaId": "994999FF-08F9-4491-A0FA-0A2AF083ADBA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dji:mini_se_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "926449F3-FAF5-4500-B185-7ECCBB9C575C", "versionEndIncluding": "01.02.0000", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dji:mini_se:-:*:*:*:*:*:*:*", "matchCriteriaId": "CEDA2491-54F4-4C4A-9142-DAB08E35F734", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via the DJI Enhanced-WiFi transmission subsystem"}, {"lang": "es", "value": "Un problema en DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 y versiones anteriores permite a un atacante remoto causar una denegaci\u00f3n de servicio a trav\u00e9s del subsistema de transmisi\u00f3n DJI Enhanced-WiFi."}], "id": "CVE-2026-26673", "lastModified": "2026-06-17T10:26:12.283", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26673", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T17:24:06.123793Z", "version": "2.0.3"}}]}, "published": "2026-03-04T16:16:27.883", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/ByteMe1001/DJI-CatNect"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.1.00.0500]"}}], "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "mavic_air", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.1.00.0500]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "mavic_mini", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.1.00.0500]"}}], "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "mini", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.1.00.0500]"}}], "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "mini_se", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.1.00.0500]"}}], "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "spark", "vendor": "dji"}], "analysis": {"en": {"generated_at": "2026-04-18T10:03:14.175821+00:00", "value": {"mitigation_remediation": ["Update the drone firmware to the newest version released by DJI that resolves the denial\u2011of\u2011service issue.", "If the Enhanced\u2011WiFi transmission subsystem is not required for your operations, disable it to eliminate the vulnerable code path.", "Apply network segmentation or firewall rules to restrict third\u2011party connections to the drone\u2019s Wi\u2011Fi interface, reducing exposure to potential remote exploitation."], "summary": {"action": "Patch Now", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Affected DJI hardware includes the Mavic Mini, Spark, Mavic Air, Mini, and Mini SE drones running firmware 0.1.00.0500 or earlier. These models are impacted by the defect in the Enhanced\u2011WiFi transmission subsystem.", "description_and_impact": "An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, and Mini SE models with firmware version 0.1.00.0500 or earlier permits a remote attacker to trigger a denial of service through the DJI Enhanced\u2011WiFi transmission subsystem. The weakness is identified as uncontrolled resource consumption (CWE-400), which can cause the drone\u2019s software to become unresponsive or reset.", "risk_and_exploitability": "The CVSS score of 7.5 classifies the vulnerability as high severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via the wireless interface, as implied by the description of a remote attacker triggering the flaw."}}}}, "created": "2026-03-05T09:08:54.298524+00:00", "title": "Denial of Service via DJI Enhanced\u2011WiFi Transmission Subsystem", "updated": "2026-04-18T10:15:25.864622+00:00", "vendors": ["dji", "dji$PRODUCT$mavic_air", "dji$PRODUCT$mavic_mini", "dji$PRODUCT$mini", "dji$PRODUCT$mini_se", "dji$PRODUCT$spark"]}