Answer in brief
CVE-2026-77812 records a Critical severity (CVSS 9.4) vulnerability in Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE. The current sources do not mark it as known exploited. The current feed maps DJI/Air 3 (generic), DJI/Air 3 (generic), DJI/Air 3S (generic), DJI/Air 3S (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps DJI/Air 3 (generic), DJI/Air 3 (generic), DJI/Air 3S (generic), DJI/Air 3S (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| DJI/Air 3generic | 0 | Not reported |
| DJI/Air 3generic | >=0 <=01.00.1600 | Not reported |
| DJI/Air 3Sgeneric | 0 | Not reported |
| DJI/Air 3Sgeneric | >=0 <=01.00.1400 | Not reported |
| DJI/Avata 2generic | 0 | Not reported |
| DJI/Avata 2generic | >=0 <=01.00.0400 | Not reported |
| DJI/Avata 360generic | 0 | Not reported |
| DJI/Avata 360generic | >=0 <=01.00.0300 | Not reported |
| DJI/DJI Air 3generic | 0 | Not reported |
| DJI/DJI Air 3Sgeneric | 0 | Not reported |
| DJI/DJI Avata 2generic | 0 | Not reported |
| DJI/DJI Avata 360generic | 0 | Not reported |
| DJI/DJI Flipgeneric | 0 | Not reported |
| DJI/DJI Flipgeneric | >=0 <=01.00.1200 | Not reported |
| DJI/DJI Mavic 3generic | 0 | Not reported |
| DJI/DJI Mavic 3 Classicgeneric | 0 | Not reported |
| DJI/DJI Mavic 3 Progeneric | 0 | Not reported |
| DJI/DJI Mavic 4 Progeneric | 0 | Not reported |
| DJI/DJI Mini 2generic | 0 | Not reported |
| DJI/DJI Mini 3generic | 0 | Not reported |
| DJI/DJI Mini 3 Progeneric | 0 | Not reported |
| DJI/DJI Mini 4 Progeneric | 0 | Not reported |
| DJI/DJI Mini 5 Progeneric | 0 | Not reported |
| DJI/DJI Neogeneric | 0 | Not reported |
| DJI/DJI Neo 2generic | 0 | Not reported |
| DJI/Mavic 3generic | 0 | Not reported |
| DJI/Mavic 3generic | >=0 <=01.00.1400 | Not reported |
| DJI/Mavic 3 Classicgeneric | 0 | Not reported |
| DJI/Mavic 3 Classicgeneric | >=0 <=01.00.0800 | Not reported |
| DJI/Mavic 3 Progeneric | 0 | Not reported |
| DJI/Mavic 3 Progeneric | >=0 <=01.01.0700 | Not reported |
| DJI/Mavic 4 Progeneric | 0 | Not reported |
| DJI/Mavic 4 Progeneric | >=0 <=01.00.0500 | Not reported |
| DJI/Mini 2generic | 0 | Not reported |
| DJI/Mini 2generic | >=0 <=01.07.0200 | Not reported |
| DJI/Mini 3generic | 0 | Not reported |
| DJI/Mini 3generic | >=0 <=01.00.0500 | Not reported |
| DJI/Mini 3 Progeneric | >=0 <=01.00.0900 | Not reported |
| DJI/Mini 3 Progeneric | 0 | Not reported |
| DJI/Mini 4 Progeneric | >=0 <=01.00.1100 | Not reported |
| DJI/Mini 4 Progeneric | 0 | Not reported |
| DJI/Mini 5 Progeneric | >=0 <=01.00.0600 | Not reported |
| DJI/Mini 5 Progeneric | 0 | Not reported |
| DJI/Neogeneric | 0 | Not reported |
| DJI/Neogeneric | >=0 <=01.00.0400 | Not reported |
| DJI/Neo 2generic | 0 | Not reported |
| DJI/Neo 2generic | >=0 <=01.00.0500 | Not reported |
Published upstream
Aug 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 21, 2026
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user. * An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network * The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices. * The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely * The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed * A BLE sniffer and presence during one normal DJI Fly connection are needed Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600. Remediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading.
Quoted source text, attributed separately from HOL analysis.