CVE-2026-78255

HighCVSS 8.7/10Last modified Oct 14, 2026

Description

The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator's routines.

Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
DJINeo<= 01.00.0400
DJINeo 2<= 01.00.0500
DJIFlip<= 01.00.1200
DJIAir 3<= 01.00.1600,
DJIAir 3S<= 01.00.1400
DJIAvata 2<= 01.00.0400
DJIAvata 360<= 01.00.0300
DJIMavic 3<= 01.00.1400
DJIMavic 3 Classic<= 01.00.0800
DJIMavic 3 Pro<= 01.01.0700
DJIMavic 4 Pro<= 01.00.0500
DJIMini 2<= 01.07.0200
DJIMini 3<= 01.00.0500
DJIMini 3 Pro<= 01.00.0900
DJIMini 4 Pro<= 01.00.1100
DJIMini 5 Pro<= 01.00.0600

References

Timeline

Published
Aug 24, 2026
Last modified
Oct 14, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-782578.8Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.CVE-2026-782585.3Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.CVE-2026-782597.3Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.CVE-2026-78269.1A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 CVE-2026-782609.3Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.CVE-2026-782617.1Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.CVE-2026-782629.8Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.CVE-2026-782637.1Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.CVE-2026-782647.1Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.CVE-2026-782659.8Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.CVE-2026-782666.5Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions.CVE-2026-782679.8Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.
CVE-2026-78255: High severity, CVSS 8.7 | Vulnix