SURIQ
Convenience features on connected hardware keep shipping without a lock on the door, and this one is bolted to something that flies. CVE-2026-78306, published on August 24, 2026, describes a control interface on DJI drones that answers commands over Bluetooth with no authentication at all. Anyone standing within Bluetooth range can rewrite the drone's wireless settings, take over its private Wi-Fi network, and knock its control link offline while it is in the air. Sixteen current models are affected, from the pocket-sized Mini line to the Mavic and Air camera drones.
The vulnerability carries a CVSS v4.0 score of 8.5 and is classified as missing authentication for a critical function (CWE-306). It was reported by researchers Abdelrahman Yousef and Dr. Jordan Samhi and coordinated through CIRCL, Luxembourg's national computer emergency response team, which assigned the identifier. There is no public exploit code and no report of exploitation in the wild as of publication. The fix is a firmware update, and the fixed build is listed for each model.
What an attacker in Bluetooth range can actually do
DJI drones speak a proprietary command protocol the hobbyist community calls DUML. On the affected firmware, the drone accepts these commands over its Bluetooth interface without checking who is sending them. That is the whole flaw: a management channel with real power over the aircraft, and the login check simply is not there. It is the same missing-login pattern behind other unauthenticated command interfaces we have covered.
From that foothold the advisory describes a few concrete outcomes. An attacker in Bluetooth range can rewrite the drone's wireless settings: the pre-shared key that guards its private network, plus the network name, hardware address, regulatory country code, and radio channel. By setting that key to a value they choose, they can join the drone's own Wi-Fi network and, the advisory says, potentially reach the flight-control interface and send flight commands. They can also switch off or reboot the wireless and Bluetooth radios, drop connected clients, or wipe the wireless configuration, which severs the operator's control, video, and telemetry link mid-flight.
Read the severity vector and the shape of the risk is clear. The scored impact is to integrity and availability, not confidentiality: this is not a bug that quietly reads your footage. It is a bug that lets a stranger change how the aircraft behaves, or knock it out of the operator's hands. The audience that should care is anyone who needs a flight to stay under its pilot's control, not a data-privacy team.
Which DJI models are affected, and the firmware that fixes it
The flaw spans DJI's current consumer and prosumer lineup. Each model is vulnerable on firmware below the build listed, and updating to that build or later closes it. If you fly any of these, check the installed firmware in the DJI app and update before the next flight.
| Model | Vulnerable below | Fixed build |
|---|---|---|
| Neo | 01.00.0400 | 01.00.0400 or later |
| Neo 2 | 01.00.0500 | 01.00.0500 or later |
| Flip | 01.00.1200 | 01.00.1200 or later |
| Air 3 | 01.00.1600 | 01.00.1600 or later |
| Air 3S | 01.00.1400 | 01.00.1400 or later |
| Avata 2 | 01.00.0400 | 01.00.0400 or later |
| Avata 360 | 01.00.0300 | 01.00.0300 or later |
| Mavic 3 | 01.00.1400 | 01.00.1400 or later |
| Mavic 3 Classic | 01.00.0800 | 01.00.0800 or later |
| Mavic 3 Pro | 01.01.0700 | 01.01.0700 or later |
| Mavic 4 Pro | 01.00.0500 | 01.00.0500 or later |
| Mini 2 | 01.07.0200 | 01.07.0200 or later |
| Mini 3 | 01.00.0500 | 01.00.0500 or later |
| Mini 3 Pro | 01.00.0900 | 01.00.0900 or later |
| Mini 4 Pro | 01.00.1100 | 01.00.1100 or later |
| Mini 5 Pro | 01.00.0600 | 01.00.0600 or later |
The spread matters more than any single row. These are not obscure units. The Mini series alone is one of the best-selling consumer drone lines in the world, and the Mavic and Air families are staples for photographers, inspection crews, and public-safety teams. A flaw that reaches across sixteen shipping models is a fleet problem, not a one-off.
Why this is a fleet and inventory problem, not just a consumer patch
The attack needs Bluetooth proximity, which sounds limiting until you picture where drones actually fly: public events, protest lines, border and perimeter patrols, incident scenes, industrial sites. In those settings someone within a few tens of meters is normal, and that someone can now interfere with the aircraft. For a hobbyist the stakes are a ruined flight. For an organization running a drone program, an interrupted control link over a crowd or a critical asset is a safety and mission problem, not a nuisance.
The organizational lesson is the boring one that keeps paying off: you cannot patch what you do not track. Drones are endpoints. They run firmware, they carry a radio stack, and they deserve the same update cadence and inventory as any laptop or server. Teams that already record every drone, its model, and its firmware version can act on this in an afternoon. Teams that treat the fleet as a drawer of gadgets will not even know which units are exposed.
This is also the same failure that keeps surfacing on edge hardware: a convenience wireless interface, shipped with no authentication, on a device most owners never think of as a computer. We have watched it play out with internet-exposed cameras being taken over and with flaws buried deep in device firmware. The pattern holds while pairing convenience keeps outranking a login prompt.
What to do now
The fix is straightforward, and the proximity requirement is a reason to act before your next flight in a busy place, not a reason to wait.
- Update firmware on every affected drone. Use the DJI app or DJI Assistant to move each model to the fixed build in the table above, then confirm the installed version. Firmware updates on these drones are routine, so this is low-friction maintenance.
- Update before you deploy, not after. Because the attack needs Bluetooth range, the highest-risk moment is flying an unpatched drone in a crowded or contested location. Patch on the bench, then take it out.
- Treat the radios as an exposure in sensitive operations. For programs flying over events, perimeters, or critical sites, assume a nearby adversary can attempt this on any unpatched unit, and prioritize those aircraft first.
- Put drones in your asset inventory. Record model and firmware version for every unit so the next drone advisory is a query, not a scavenger hunt.
No exploit is circulating yet, and the impact is disruption rather than data theft, so this is not a five-alarm fire. It is, though, a clean reminder that anything with a radio and a command channel is part of your attack surface, drones included. The operators who already treat their fleet that way will close this out quietly. The rest will be checking sixteen model numbers by hand.