DJI Mini 2 vulnerabilities

Latest DJI Mini 2 CVEs

Newest publication first

1. CVE-2026-78321 DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion

   Published 2026-08-24

   Medium·CVSS 6.0 EPSS 0.24%

   The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server fr...

2. CVE-2026-78306 DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution

   Published 2026-08-24

   High·CVSS 8.5 EPSS 0.30%

   DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the W...

3. CVE-2026-78255 DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media

   Published 2026-08-24

   High·CVSS 8.7 EPSS 0.41%

   The HTTP media server running on DJI drones serves stored photos and videos through the /v2 endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and...

4. CVE-2026-78251 DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory

   Published 2026-08-24

   Critical·CVSS 9.3 EPSS 0.41%

   DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that di...

5. CVE-2026-77812 Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE

   Published 2026-08-21

   Critical·CVSS 9.4 EPSS 0.12%

   DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML me...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.