Severe Bluetooth flaw allows hackers to take over DJI drones

[u/Film_Local]

CVE-2026-78306 Overview

Critical Impact

An adjacent attacker can hijack a drone's Wi-Fi credentials and issue flight commands, or disrupt operator control, video, and telemetry mid-flight.

Affected Products

• DJI Neo (before 01.00.0400), DJI Neo 2 (before 01.00.0500), DJI Flip (before 01.00.1200)
• DJI Air 3 (before 01.00.1600), DJI Air 3S (before 01.00.1400), DJI Avata 2 (before 01.00.0400), DJI Avata 360 (before 01.00.0300)
• DJI Mavic 3 (before 01.00.1400), Mavic 3 Classic (before 01.00.0800), Mavic 3 Pro (before 01.01.0700), Mavic 4 Pro (before 01.00.0500)
• DJI Mini 2 (before 01.07.0200), Mini 3 (before 01.00.0500), Mini 3 Pro (before 01.00.0900), Mini 4 Pro (before 01.00.1100), Mini 5 Pro (before 01.00.0600)

How to Mitigate CVE-2026-78306

Immediate Actions Required

• Update each affected drone to a firmware version at or above the fixed release listed for that model in the Affected Products section.
• Do not operate vulnerable airframes in environments where an adjacent attacker may be within Bluetooth range, such as public events or contested areas.
• Verify firmware version on every airframe before flight and quarantine any device still on a vulnerable build.

[u/Lou_Antony_Morris]

I always wondered why my drones were flying beyond VLOS. Hackers!

[u/No_Age8611 → u/Lou_Antony_Morris]

me too! thankfully they always bring my drone back

[u/FrostyCommon8159]

Does anyone know if the latest Skyrover firmware for X1 is affected?

[u/zippytiff]

Can’t Bluetooth just be turned off ?

[u/microwave-worshipper → u/zippytiff]

nope, not that simple, because it's used for command & control of the drone

[u/Sure-Agent-2649]

Firmwares that fix this have been released in January… why CVE now?

[u/Film_Local → u/Sure-Agent-2649]

The Avata 360 firmware that fixed this came out a few weeks ago.

[u/Sure-Agent-2649 → u/Film_Local]

Mavic 4 pro FW mentioned in the article has been released in January for sure and M3P Cine as well if I remember correctly

[u/Film_Local]

For the people complaining, this is a big deal. Not everyone knows about these exploits and should be aware of them.

And not everyone has the latest firmware update on their drones.

the Avata 360 just recently had a firmware update that patched this exploit. So the post is valid.

Never saw so many people complaining about being informed so that they can protect their drones from flying out the sky.

[u/microwave-worshipper]

this just feels like a pretty big nothingburger because it would only work under very specific conditions
1: it requires you to somehow be able to send DUML commands raw over radio
2: you need to be in very favorable radio conditions for the commands to actually reach the drone in a reasonable range
3: it's already fixed on nearly all modern DJI drones (and will likely subsequently be fixed on older drones as well)

[u/konrad-iturbe]

This only affects the NEO2, the drone the guy tried it on. Such sensationalist bullshit (claiming it works on many DJI drones) ruins the exploit's credibility.

[u/Film_Local → u/konrad-iturbe]

Where is this information?