Abdelrahman Yousef

An FTP service uses hardcoded credentials shared across multiple models, allowing authenticated users to overwrite existing files or upload files without restrictions on size, count, or total storage in the `/blackbox/upgrade/` endpoint. An attacker with access to the internal network or USB RNDIS interface can exhaust available storage, which may prevent the aircraft from recording flight records, logs, and telemetry, and could block future firmware updates. Uploaded files remain on the device after a reboot or factory reset.

The HTTP media server on certain drones serves stored photos and videos through the `/v2` endpoint without requiring client authentication. Because filenames follow a predictable pattern, an attacker on the drone's internal network can enumerate filenames to exfiltrate media. This exposure may reveal sensitive data such as private locations, travel history, and identifiable individuals.

An unauthenticated DUML command interface is exposed over Bluetooth, allowing an attacker within range to modify Wi-Fi configuration parameters such as the SSID, PSK, MAC address, regulatory country code, and wireless channel. By overwriting the Wi-Fi PSK with a known value, an attacker can connect to the internal Wi-Fi network to potentially access the flight control interface and issue flight commands. Additionally, crafted DUML commands can disable or restart Wi-Fi and Bluetooth interfaces, disconnect clients, or reset wireless configurations, leading to a denial-of-service condition that disrupts wireless control, video, and telemetry connections during flight.

The HTTP media server fails to enforce sufficient limits on request rates or incoming connections. An attacker with access to the internal network can exhaust the server connection pool by repeatedly requesting stored media files. This results in a denial of service, preventing the DJI Fly application from retrieving photos and videos from the aircraft while in QuickTransfer mode.

DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. During Wi-Fi connection attempts or when in QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE. An attacker within BLE range can passively sniff this traffic to recover cleartext credentials, including the Wi-Fi PSK, SSID, and the trusted identifier `UUID`. This allows an attacker to join the drone's internal Wi-Fi network, interact with exposed network services, and decrypt Wi-Fi traffic between the drone and the user. Additionally, the captured `UUID` can be replayed to bypass physical confirmation for new connected devices. These credentials remain valid indefinitely unless the operator manually resets the Wi-Fi settings. The attack is entirely passive, leaving no indication to the operator or the drone that the session was observed.