CVE-2026-78255

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata 360 versions prior to 01.00.0300 DJI Mavic 3 versions prior to 01.00.1400 DJI Mavic 3 Classic versions prior to 01.00.0800 DJI Mavic 3 Pro versions prior to 01.01.0700 DJI Mavic 4 Pro versions prior to 01.00.0500 DJI Mini 2 versions prior to 01.07.0200 DJI Mini 3 versions prior to 01.00.0500 DJI Mini 3 Pro versions prior to 01.00.0900 DJI Mini 4 Pro versions prior to 01.00.1100 DJI Mini 5 Pro versions prior to 01.00.0600

Description The HTTP media server on certain drones serves stored photos and videos through the /v2 endpoint without requiring client authentication. Because filenames follow a predictable pattern, an attacker on the drone's internal network can enumerate filenames to exfiltrate media. This exposure may reveal sensitive data such as private locations, travel history, and identifiable individuals.

Recommendations Update DJI Neo to version 01.00.0400 or later. Update DJI Neo 2 to version 01.00.0500 or later. Update DJI Flip to version 01.00.1200 or later. Update DJI Air 3 to version 01.00.1600 or later. Update DJI Air 3S to version 01.00.1400 or later. Update DJI Avata 2 to version 01.00.0400 or later. Update DJI Avata 360 to version 01.00.0300 or later. Update DJI Mavic 3 to version 01.00.1400 or later. Update DJI Mavic 3 Classic to version 01.00.0800 or later. Update DJI Mavic 3 Pro to version 01.01.0700 or later. Update DJI Mavic 4 Pro to version 01.00.0500 or later. Update DJI Mini 2 to version 01.07.0200 or later. Update DJI Mini 3 to version 01.00.0500 or later. Update DJI Mini 3 Pro to version 01.00.0900 or later. Update DJI Mini 4 Pro to version 01.00.1100 or later. Update DJI Mini 5 Pro to version 01.00.0600 or later.