A large Bluetooth gap in sixteen best-selling DJI drones might allow a close hacker to stop the pilot and steal the plane needing no login.
This error hits the Chinese business drone company’s Mavic and Mini lines plus Air 3, Air 3/3S, Neo, Flip, and Avata 2/360.
Protection experts Abdelrahman Yousef and Doctor Jordan Samhi identified the defect, logged as CVE-2026-78306, regarding how DJI drones verify commands transmitted via their Bluetooth connection.
The defect scores 8.5 out of 10 for severity, indicating it is a serious weakness needing prompt action.
How It Functions
According to the defect details, Bluetooth links to the drone’s WiFi interface and swaps network info, yet experts noted just three orders – fetching the WiFi networks name, password and MAC address – truly validate a trusted Universally Unique Identifier (UUID).
Other orders miss that same validation, allowing anyone near Bluetooth range to transmit illegal directives using DUML – DJI’s specific tongue for drone-to-controller talk.
The researchers proof of concept (PoC) demonstrates unverified orders can:
- Change the WiFi secret and SSID
- Modify wireless parameters
- Disable or reboot WiFi and Bluetooth
- Restart or shut down the plane
- Reset setups
Some resets touch the planes system, flight manager, gimbal, camera, WiFi and software-defined radio setup.
Other resets may erase the planes media memory and clear its system records.
Built for the sky.
Ready for the next mission.
DJI drones combine aerial imaging, intelligent flight features and compact design for creators, mapping, inspection and professional applications.
Danger Alert
In their notice, the experts caution that their PoC might lead to data loss, setting changes, link loss, and machine trouble, stressing it must only run in safe spots and on machines where researchers have permission to check.
The experts note their test tool also adds a further check before orders they view as risky.
One order resetting the system, flight manager, gimbal, camera, WiFi, and software-defined radio setup states:
“The FC config reset can start the motors.”
Mid-Air Capture?
A bad actor might use these bugs to alter the drones WiFi secret, enter its inside net, and maybe find a route to the flight control panel – getting power to give flight orders.
However, mid-air capture is a possible result instead of what the experts showed in their PoC.
There are now zero reports of this bug being used outside labs, and it is absent from CISA’s Known Used Weakness list.
Even if criminals do not fully seize a drone, the experts agree a “link loss” can happen – signifying the bond between the drone and the pilot breaks or gets messed up.
With drones serving tasks ranging from photos and mapping to drops and police spying, trouble could bring results far past the craft alone.
More DJI Defects Found
CVE-2026-78306 was among many DJI weaknesses Yousef and Samhi revealed in August.
Other issues featured a media server needing no login to join, an FTP…
