CVE-2026-78321: Neo 0 through 01.00.0400; +15 more affected products

Affected technology

Neo · 0 through 01.00.0400,
DJI

Neo 2 · 0 through 01.00.0500
DJI

Flip · 0 through 01.00.1200
DJI

Air 3 · 0 through 01.00.1600
DJI

Air 3S · 0 through 01.00.1400
DJI

Avata 2 · 0 through 01.00.0400
DJI

Avata 360 · 0 through 01.00.0300
DJI

Mavic 3 · 0 through 01.00.1400
DJI

Mavic 3 Classic · 0 through 01.00.0800
DJI

Mavic 3 Pro · 0 through 01.01.0700
DJI

Mavic 4 Pro · 0 through 01.00.0500
DJI

Mini 2 · 0 through 01.07.0200,
DJI

Mini 3 · 0 through 01.00.0500
DJI

Mini 3 Pro · 0 through 01.00.0900
DJI

Mini 4 Pro · 0 through 01.00.1100
DJI

Mini 5 Pro · 0 through 01.00.0600
DJI

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Adjacent network · No privileges required · No user interaction required

What an attacker can do

An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling legitimate requests and causing a denial of service that prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode. Source advisory’s CVSS 4.0 assessment (base score 6.0/10) rates confidentiality and integrity impact as none; availability impact as high.