CVE-2026-78255: Neo 0 through 01.00.0400; +15 more affected products

Affected technology

Neo · 0 through 01.00.0400
DJI

Neo 2 · 0 through 01.00.0500
DJI

Flip · 0 through 01.00.1200
DJI

Air 3 · 0 through 01.00.1600,
DJI

Air 3S · 0 through 01.00.1400
DJI

Avata 2 · 0 through 01.00.0400
DJI

Avata 360 · 0 through 01.00.0300
DJI

Mavic 3 · 0 through 01.00.1400
DJI

Mavic 3 Classic · 0 through 01.00.0800
DJI

Mavic 3 Pro · 0 through 01.01.0700
DJI

Mavic 4 Pro · 0 through 01.00.0500
DJI

Mini 2 · 0 through 01.07.0200
DJI

Mini 3 · 0 through 01.00.0500
DJI

Mini 3 Pro · 0 through 01.00.0900
DJI

Mini 4 Pro · 0 through 01.00.1100
DJI

Mini 5 Pro · 0 through 01.00.0600
DJI

Description’s affected range: through the `/v2` endpoint without authenticating the requesting client

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality impact as high; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.