CVE-2026-78251

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata 360 versions prior to 01.00.0300 DJI Mavic 3 versions prior to 01.00.1400 DJI Mavic 3 Classic versions prior to 01.00.0800 DJI Mavic 3 Pro versions prior to 01.01.0700 DJI Mavic 4 Pro versions prior to 01.00.0500 DJI Mini 2 versions prior to 01.07.0200 DJI Mini 3 versions prior to 01.00.0500 DJI Mini 3 Pro versions prior to 01.00.0900 DJI Mini 4 Pro versions prior to 01.00.1100 DJI Mini 5 Pro versions prior to 01.00.0600

Description An FTP service uses hardcoded credentials shared across multiple models, allowing authenticated users to overwrite existing files or upload files without restrictions on size, count, or total storage in the /blackbox/upgrade/ endpoint. An attacker with access to the internal network or USB RNDIS interface can exhaust available storage, which may prevent the aircraft from recording flight records, logs, and telemetry, and could block future firmware updates. Uploaded files remain on the device after a reboot or factory reset.

Recommendations Update firmware for DJI Neo to version 01.00.0400 or later. Update firmware for DJI Neo 2 to version 01.00.0500 or later. Update firmware for DJI Flip to version 01.00.1200 or later. Update firmware for DJI Air 3 to version 01.00.1600 or later. Update firmware for DJI Air 3S to version 01.00.1400 or later. Update firmware for DJI Avata 2 to version 01.00.0400 or later. Update firmware for DJI Avata 360 to version 01.00.0300 or later. Update firmware for DJI Mavic 3 to version 01.00.1400 or later. Update firmware for DJI Mavic 3 Classic to version 01.00.0800 or later. Update firmware for DJI Mavic 3 Pro to version 01.01.0700 or later. Update firmware for DJI Mavic 4 Pro to version 01.00.0500 or later. Update firmware for DJI Mini 2 to version 01.07.0200 or later. Update firmware for DJI Mini 3 to version 01.00.0500 or later. Update firmware for DJI Mini 3 Pro to version 01.00.0900 or later. Update firmware for DJI Mini 4 Pro to version 01.00.1100 or later. Update firmware for DJI Mini 5 Pro to version 01.00.0600 or later.