CVE-2026-77812

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77812", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-08-21T14:06:52.579Z", "datePublished": "2026-08-21T14:06:55.723Z", "dateUpdated": "2026-11-06T11:19:05.887Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Neo", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0400", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Neo 2", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0500", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "DJI Flip", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1200", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Air 3", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1600", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Air 3S", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1400", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Avata 2", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0400", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Avata 360", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0300", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mavic 3", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1400", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mavic 3 Classic", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0800", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mavic 3 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.01.0700", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mavic 4 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0500", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 2", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.07.0200", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 3", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0500", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 3 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0900", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 4 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1100", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 5 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0600", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Abdelrahman Yousef"}, {"lang": "en", "type": "finder", "value": "Dr. Jordan Samhi"}, {"lang": "en", "type": "finder", "value": "Lloren\u00e7 Rom\u00e1 Alvarez, Cyber-Defence Campus, Armasuisse"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.<br><br>* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network <br>* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.<br>* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely<br>* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed<br>* A BLE sniffer and presence during one normal DJI Fly connection are needed<br><br>Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.<br><br>Remediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading."}], "value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.\n\n* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network \n* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.\n* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely\n* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed\n* A BLE sniffer and presence during one normal DJI Fly connection are needed\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\nRemediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-311", "description": "CWE-311 Missing Encryption of Sensitive Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-11-06T11:19:05.887Z"}, "references": [{"tags": ["technical-description"], "url": "https://support.dji.com/help/content?customId=en-us03400011149&amp;spaceId=34&amp;re=US&amp;lang=en"}, {"tags": ["technical-description"], "url": "https://github.com/Wh02m1/CVE-2026-77812"}, {"tags": ["technical-description"], "url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-77812/"}], "source": {"discovery": "UNKNOWN"}, "title": "Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE", "x_gcve": [{"recordType": "advisory", "vulnId": "gcve-1-2026-20157"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T17:42:02.404909Z", "id": "CVE-2026-77812", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T17:42:36.191Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77812", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T17:42:02.404909Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T17:42:29.963Z"}}], "cna": {"title": "Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE", "source": {"discovery": "UNKNOWN"}, "x_gcve": [{"vulnId": "gcve-1-2026-20157", "recordType": "advisory"}], "credits": [{"lang": "en", "type": "finder", "value": "Abdelrahman Yousef"}, {"lang": "en", "type": "finder", "value": "Dr. Jordan Samhi"}, {"lang": "en", "type": "finder", "value": "Lloren\u00e7 Rom\u00e1 Alvarez, Cyber-Defence Campus, Armasuisse"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "DJI", "product": "Neo", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "01.00.0400"}], "defaultStatus": "unaffected"}, {"vendor": "DJI", "product": "Neo 2", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "01.00.0500"}], "defaultStatus": "unaffected"}, {"vendor": "DJI", "product": "DJI Flip", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "01.00.1200"}], "defaultStatus": "unaffected"}, {"vendor": "DJI", "product": "Air 3", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "01.00.1600"}], "defaultStatus": "unaffected"}, {"vendor": "DJI", "product": "Air 3S", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "01.00.1400"}], "defaultStatus": "unaffected"}, {"vendor": "DJI", "product": "Avata 2", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "01.00.0400"}], "defaultStatus": "unaffected"}, {"vendor": "DJI", "product": "Avata 360", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "01.00.0300"}], "defaultStatus": "unaffected"}, {"vendor": "DJI", "product": "Mavic 3", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "01.00.1400"}], "defaultStatus": "unaffected"}, {"vendor": "DJI", "product": "Mavic 3 Classic", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "01.00.0800"}], "defaultStatus": "unaffected"}, {"vendor": "DJI", "product": "Mavic 3 Pro", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "01.01.0700"}], "defaultStatus": "unaffected"}, {"vendor": "DJI", "product": "Mavic 4 Pro", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "01.00.0500"}], "defaultStatus": "unaffected"}, {"vendor": "DJI", "product": "Mini 2", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "01.07.0200"}], "defaultStatus": "unaffected"}, {"vendor": "DJI", "product": "Mini 3", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "01.00.0500"}], "defaultStatus": "unaffected"}, {"vendor": "DJI", "product": "Mini 3 Pro", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "01.00.0900"}], "defaultStatus": "unaffected"}, {"vendor": "DJI", "product": "Mini 4 Pro", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "01.00.1100"}], "defaultStatus": "unaffected"}, {"vendor": "DJI", "product": "Mini 5 Pro", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "01.00.0600"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.dji.com/help/content?customId=en-us03400011149&amp;spaceId=34&amp;re=US&amp;lang=en", "tags": ["technical-description"]}, {"url": "https://github.com/Wh02m1/CVE-2026-77812", "tags": ["technical-description"]}, {"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-77812/", "tags": ["technical-description"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.\n\n* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network \n* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.\n* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely\n* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed\n* A BLE sniffer and presence during one normal DJI Fly connection are needed\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\nRemediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading.", "supportingMedia": [{"type": "text/html", "value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.<br><br>* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network <br>* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.<br>* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely<br>* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed<br>* A BLE sniffer and presence during one normal DJI Fly connection are needed<br><br>Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.<br><br>Remediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-311", "description": "CWE-311 Missing Encryption of Sensitive Data"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-11-06T11:19:05.887Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77812", "state": "PUBLISHED", "dateUpdated": "2026-11-06T11:19:05.887Z", "dateReserved": "2026-08-21T14:06:52.579Z", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "datePublished": "2026-08-21T14:06:55.723Z", "assignerShortName": "CIRCL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Neo", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0400", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Neo 2", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0500", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "DJI Flip", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1200", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Air 3", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1600", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Air 3S", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1400", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Avata 2", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0400", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Avata 360", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0300", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mavic 3", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1400", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mavic 3 Classic", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0800", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mavic 3 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.01.0700", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mavic 4 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0500", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 2", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.07.0200", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 3", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0500", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 3 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0900", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 4 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1100", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 5 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0600", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.\n\n* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network \n* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.\n* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely\n* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed\n* A BLE sniffer and presence during one normal DJI Fly connection are needed\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\nRemediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading."}, {"lang": "es", "value": "Los drones DJI transmiten mensajes del protocolo DUML (DJI Universal Markup Language) a trav\u00e9s de BLE (Bluetooth Low Energy) sin cifrado. Cuando un cliente intenta conectarse al drone a trav\u00e9s de Wi-Fi, o cuando el drone se cambia al modo QuickTransfer, la aplicaci\u00f3n DJI Fly intercambia mensajes DUML con el drone a trav\u00e9s de BLE, incluyendo las credenciales de Wi-Fi. Un atacante dentro del alcance de BLE puede esnifar pasivamente este tr\u00e1fico y recuperar las credenciales en texto claro, incluyendo el PSK, SSID y el UUID de identificador de confianza del Wi-Fi del drone. La obtenci\u00f3n de estas credenciales permite al atacante unirse a la red Wi-Fi interna del drone, interactuar con los servicios de red expuestos por el drone, y descifrar el tr\u00e1fico Wi-Fi intercambiado entre el drone y el usuario leg\u00edtimo.\n\n* Un atacante dentro del alcance de BLE recupera el SSID y el PSK del Wi-Fi en texto claro, y luego puede unirse a la red del drone.\n* La misma captura tambi\u00e9n expone el identificador UUID de la sesi\u00f3n, que es lo \u00fanico que el drone utiliza para distinguir un cliente de confianza de uno desconocido, por lo que el atacante puede reproducirlo y omitir la confirmaci\u00f3n f\u00edsica de nuevos dispositivos conectados.\n* Las credenciales no cambian entre sesiones a menos que el operador reinicie manualmente la configuraci\u00f3n de Wi-Fi, por lo que una captura permanece v\u00e1lida indefinidamente.\n* El ataque es completamente pasivo, sin que se transmita nada y sin que se establezca ninguna conexi\u00f3n, por lo que ni el operador ni el drone tienen ninguna indicaci\u00f3n de que la sesi\u00f3n fue observada.\n* Se necesita un sniffer de BLE y presencia durante una conexi\u00f3n normal de DJI Fly.\n\nLos modelos afectados son DJI Neo hasta 01.00.0400, DJI Neo 2 hasta 01.00.0500, DJI Flip hasta 01.00.1200, DJI Air 3 hasta 01.00.1600, DJI Air 3S hasta 01.00.1400, DJI Avata 2 hasta 01.00.0400, DJI Avata 360 hasta 01.00.0300, DJI Mavic 3 hasta 01.00.1400, DJI Mavic 3 Classic hasta 01.00.0800, DJI Mavic 3 Pro hasta 01.01.0700, DJI Mavic 4 Pro hasta 01.00.0500, DJI Mini 2 hasta 01.07.0200, DJI Mini 3 hasta 01.00.0500, DJI Mini 3 Pro hasta 01.00.0900, DJI Mini 4 Pro hasta 01.00.1100, y DJI Mini 5 Pro hasta 01.00.0600.\n\nLa remediaci\u00f3n requiere una actualizaci\u00f3n de firmware del proveedor. No existe una mitigaci\u00f3n por parte del usuario que aborde completamente la vulnerabilidad sin actualizar."}], "id": "CVE-2026-77812", "lastModified": "2026-11-06T12:17:22.050", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77812", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T17:42:02.404909Z", "version": "2.0.3"}}]}, "published": "2026-08-21T15:16:47.557", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-77812/"}, {"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/Wh02m1/CVE-2026-77812"}, {"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://support.dji.com/help/content?customId=en-us03400011149&amp;spaceId=34&amp;re=US&amp;lang=en"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-311"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,01.00.1600]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "DJI Air 3", "source": "cna", "vendor": "DJI"}, "product": "air_3", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,01.00.1400]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "DJI Air 3S", "source": "cna", "vendor": "DJI"}, "product": "air_3s", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,01.00.0400]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DJI Avata 2", "source": "cna", "vendor": "DJI"}, "product": "dji_avata_2", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,01.00.0300]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DJI Avata 360", "source": "cna", "vendor": "DJI"}, "product": "dji_avata_360", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,01.00.0800]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DJI Mavic 3 Classic", "source": "cna", "vendor": "DJI"}, "product": "dji_mavic_3_classic", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,01.00.0500]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DJI Mavic 4 Pro", "source": "cna", "vendor": "DJI"}, "product": "dji_mavic_4_pro", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,01.00.0900]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DJI Mini 3 Pro", "source": "cna", "vendor": "DJI"}, "product": "dji_mini_3_pro", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,01.00.1100]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DJI Mini 4 Pro", "source": "cna", "vendor": "DJI"}, "product": "dji_mini_4_pro", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,01.00.0600]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DJI Mini 5 Pro", "source": "cna", "vendor": "DJI"}, "product": "dji_mini_5_pro", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,01.00.0400]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DJI Neo", "source": "cna", "vendor": "DJI"}, "product": "dji_neo", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,01.00.0500]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DJI Neo 2", "source": "cna", "vendor": "DJI"}, "product": "dji_neo_2", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,01.00.1200]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "DJI Flip", "source": "cna", "vendor": "DJI"}, "product": "flip", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,01.00.1400]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "DJI Mavic 3", "source": "cna", "vendor": "DJI"}, "product": "mavic_3", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,01.01.0700]"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 85.0, "source": "matching"}]}, "original": {"product": "DJI Mavic 3 Pro", "source": "cna", "vendor": "DJI"}, "product": "mavic_3", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,01.07.0200]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "DJI Mini 2", "source": "cna", "vendor": "DJI"}, "product": "mini_2", "vendor": "dji"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,01.00.0500]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "DJI Mini 3", "source": "cna", "vendor": "DJI"}, "product": "mini_3", "vendor": "dji"}], "created": "2026-08-21T15:45:18.195954+00:00", "updated": "2026-08-21T21:15:32.458763+00:00", "vendors": ["dji", "dji$PRODUCT$air_3", "dji$PRODUCT$air_3s", "dji$PRODUCT$dji_avata_2", "dji$PRODUCT$dji_avata_360", "dji$PRODUCT$dji_mavic_3_classic", "dji$PRODUCT$dji_mavic_4_pro", "dji$PRODUCT$dji_mini_3_pro", "dji$PRODUCT$dji_mini_4_pro", "dji$PRODUCT$dji_mini_5_pro", "dji$PRODUCT$dji_neo", "dji$PRODUCT$dji_neo_2", "dji$PRODUCT$flip", "dji$PRODUCT$mavic_3", "dji$PRODUCT$mini_2", "dji$PRODUCT$mini_3"]}