Skip to content
OpenAdvisories

Vendor

DJI

21 known vulnerabilities.

Products

Mini 3 Pro 14 Mavic 3 12 Mavic 3 Classic 12 Mavic 3 Pro 12 Mavic 3 Enterprise 7 Matrice 300 7 Matrice M30 7 CrystalSky ZS600C 5 Neo 5 Neo 2 5 Air 3 5 Air 3S 5 Avata 2 5 Avata 360 5 Mavic 4 Pro 5 Mini 2 5 Mini 3 5 Mini 4 Pro 5 Mini 5 Pro 5 Flip 4 Mavic Mini 2 DJI Flip 1 Air 1 Spark 1 Mini SE 1 Mavic Spark 1 Mavic Air 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.0
    CVE-2026-114356

    DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization

    Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-d…

    DJI CrystalSky ZS600C
  • High 8.6
    CVE-2026-114355

    DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root

    OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log…

    DJI CrystalSky ZS600C
  • High 8.6
    CVE-2026-114354

    DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root

    Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, bec…

    DJI CrystalSky ZS600C
  • High 7.0
    CVE-2026-114353

    DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution

    Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by send…

    DJI CrystalSky ZS600C
  • High 8.5
    CVE-2026-78306 Public exploit

    DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution

    DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacke…

    DJI Mini 3 Pro Mavic 3 Mavic 3 Pro
  • High 8.7
    CVE-2026-78255

    DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media

    The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumera…

    DJI Mini 3 Pro Mavic 3 Classic Mavic 3