DJI has 7 CVEs on record. Disclosure cadence is accelerating: 7 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 5. The median CVSS is 8.5 (high), with 1 rated critical. None have a confirmed exploitation report. Most affected products: CrystalSky ZS600C (5), Neo (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.5
- Publish → KEV
- —
- Last 90 days
- 7 prev 0
Worst active — by depth score
CVE-2026-77812Critical· 9.4DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption64CVE-2026-78306High· 8.5DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wirele…59CVE-2026-114355High· 8.6DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root47CVE-2026-114354High· 8.6DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root47CVE-2026-114357High· 7.0DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)39
DJI vulnerabilities
CVEs affecting DJI, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-114354High· 8.6DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS…
CVE-2026-114353High· 7.0DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS co…
CVE-2026-114355High· 8.6DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root
OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted l…
CVE-2026-114357High· 7.0DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privile…
CVE-2026-114356High· 7.0DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including fac…
CVE-2026-78306High· 8.5PoCDJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wirele…
DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wirele…
CVE-2026-77812Critical· 9.4PoCDJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode…