DJI vulnerabilities
We track 13 vulnerabilities in DJI products across 33 products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest DJI vulnerabilities
- 8.8 High severity
AeroScope Mobile (TP703): Improper Verification of Cryptographic Signature
Improper verification of cryptographic signature (CWE-347) in the firmware update handler of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmwar
- 8.8 High severity
AeroScope Mobile (TP703): Improper Neutralization of Special Elements used in an OS Command
OS command injection (CWE-78) in the network-configuration handling of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through
- 9.3 Critical severity
CrystalSky ZS600C: Missing Authentication for Critical Functionality
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root.
- 7.0 High severity
CrystalSky ZS600C: Missing Authorization
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-da
- 8.6 High severity
CrystalSky ZS600C: Improper Neutralization of Special Elements used in an OS Command
OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log
- 8.6 High severity
CrystalSky ZS600C: Improper Neutralization of Special Elements used in an OS Command
Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, beca
- 7.0 High severity
CrystalSky ZS600C: Hidden Functionality
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sendi
- 9.3 Critical severity
Neo: Use of Hard-coded Credentials
DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite e
- 8.5 High severity
Neo: Missing Authentication for Critical Functionality
DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker
- 8.7 High severity
Neo: Missing Authentication for Critical Functionality
The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerat
- 9.4 Critical severity
Neo: Missing Encryption of Sensitive Data
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly applicati
- 7.5 High severity
Mavic Mini Firmware: Uncontrolled Resource Consumption
An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via the DJI Enhanced-WiFi transmission subsystem
- 7.5 High severity
Mavic 3 Firmware: Cleartext Transmission of Sensitive Information
DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol.