CVE-2026-78306: Neo 0 through 01.00.0400; +15 more affected products

Affected technology

Neo · 0 through 01.00.0400
DJI

Neo 2 · 0 through 01.00.0500
DJI

Flip · 0 through 01.00.1200
DJI

Air 3 · 0 through 01.00.1600
DJI

Air 3S · 0 through 01.00.1400
DJI

Avata 2 · 0 through 01.00.0400
DJI

Avata 360 · 0 through 01.00.0300
DJI

Mavic 3 · 0 through 01.00.1400
DJI

Mavic 3 Classic · 0 through 01.00.0800
DJI

Mavic 3 Pro · 0 through 01.01.0700
DJI

Mavic 4 Pro · 0 through 01.00.0500
DJI

Mini 2 · 0 through 01.07.0200
DJI

Mini 3 · 0 through 01.00.0500
DJI

Mini 3 Pro · 0 through 01.00.0900
DJI

Mini 4 Pro · 0 through 01.00.1100
DJI

Mini 5 Pro · 0 through 01.00.0600
DJI

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Adjacent network · No privileges required · No user interaction required

What an attacker can do

An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone's internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Source advisory’s CVSS 4.0 assessment (base score 8.5/10) rates confidentiality impact as none; integrity and availability impact as high.