Dji Mini 3 vulnerabilities

5 CVEs affecting Dji Mini 3, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-78251, published 2026-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-78251, published 2026-08-27. Critical severity, CVSS 9.3. EPSS: 0.4% chance of exploitation in the next 30 days. DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total…
CVE-2026-78255, published 2026-08-24. High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days. The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing…
CVE-2026-78321, published 2026-08-24. Medium severity, CVSS 6.0. EPSS: 0.2% chance of exploitation in the next 30 days. The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's…
CVE-2026-78306, published 2026-08-24. High severity, CVSS 8.5. EPSS: 0.2% chance of exploitation in the next 30 days. DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC…
CVE-2026-77812, published 2026-08-21. Critical severity, CVSS 9.4. EPSS: 0.1% chance of exploitation in the next 30 days. DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the…