CVE-2026-78255 (GCVE-0-2026-78255)

Vulnerability from cvelistv5 – Published: 2026-08-24 07:25 – Updated: 2026-08-24 07:25
VLAI
Title
DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media
Summary
The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator's routines. Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
CWE
  • CWE-306 - Missing Authentication for Critical Function
Assigner
References
Impacted products
Vendor Product Version CPE status
DJI Neo Affected: 0 , ≤ 01.00.0400 (semver)
guessed Create a notification for this product.
DJI Neo 2 Affected: 0 , ≤ 01.00.0500 (semver)
guessed Create a notification for this product.
DJI Flip Affected: 0 , ≤ 01.00.1200 (semver)
guessed Create a notification for this product.
DJI Air 3 Affected: 0 , ≤ 01.00.1600, (semver)
guessed Create a notification for this product.
DJI Air 3S Affected: 0 , ≤ 01.00.1400 (semver)
guessed Create a notification for this product.
DJI Avata 2 Affected: 0 , ≤ 01.00.0400 (semver)
guessed Create a notification for this product.
DJI Avata 360 Affected: 0 , ≤ 01.00.0300 (semver)
guessed Create a notification for this product.
DJI Mavic 3 Affected: 0 , ≤ 01.00.1400 (semver)
guessed Create a notification for this product.
DJI Mavic 3 Classic Affected: 0 , ≤ 01.00.0800 (semver)
guessed Create a notification for this product.
DJI Mavic 3 Pro Affected: 0 , ≤ 01.01.0700 (semver)
guessed Create a notification for this product.
DJI Mavic 4 Pro Affected: 0 , ≤ 01.00.0500 (semver)
guessed Create a notification for this product.
DJI Mini 2 Affected: 0 , ≤ 01.07.0200 (semver)
guessed Create a notification for this product.
DJI Mini 3 Affected: 0 , ≤ 01.00.0500 (semver)
guessed Create a notification for this product.
DJI Mini 3 Pro Affected: 0 , ≤ 01.00.0900 (semver)
guessed Create a notification for this product.
DJI Mini 4 Pro Affected: 0 , ≤ 01.00.1100 (semver)
guessed Create a notification for this product.
DJI Mini 5 Pro Affected: 0 , ≤ 01.00.0600 (semver)
guessed Create a notification for this product.
Credits
Abdelrahman Yousef Dr. Jordan Samhi
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Neo",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0400",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Neo 2",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0500",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Flip",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1200",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Air 3",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1600,",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Air 3S",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1400",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Avata 2",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0400",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Avata 360",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0300",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mavic 3",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1400",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mavic 3 Classic",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0800",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mavic 3 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.01.0700",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mavic 4 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0500",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 2",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.07.0200",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 3",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0500",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 3 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0900",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 4 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1100",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 5 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0600",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abdelrahman Yousef"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Dr. Jordan Samhi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone\u0027s internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator\u0027s routines.\u003cbr\u003e\u003cbr\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone\u0027s internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator\u0027s routines.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-24T07:25:24.159Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "tags": [
            "product"
          ],
          "url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-78255",
    "datePublished": "2026-08-24T07:25:24.159Z",
    "dateReserved": "2026-08-24T07:25:18.359Z",
    "dateUpdated": "2026-08-24T07:25:24.159Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-78255\",\"sourceIdentifier\":\"5a6e4751-2f3f-4070-9419-94fb35b644e8\",\"published\":\"2026-08-24T08:16:33.967\",\"lastModified\":\"2026-08-24T08:16:33.967\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone\u0027s internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator\u0027s routines.\\n\\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\"}],\"affected\":[{\"source\":\"5a6e4751-2f3f-4070-9419-94fb35b644e8\",\"affectedData\":[{\"vendor\":\"DJI\",\"product\":\"Neo\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.00.0400\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"DJI\",\"product\":\"Neo 2\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.00.0500\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"DJI\",\"product\":\"Flip\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.00.1200\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"DJI\",\"product\":\"Air 3\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.00.1600,\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"DJI\",\"product\":\"Air 3S\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.00.1400\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"DJI\",\"product\":\"Avata 2\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.00.0400\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"DJI\",\"product\":\"Avata 360\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.00.0300\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"DJI\",\"product\":\"Mavic 3\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.00.1400\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"DJI\",\"product\":\"Mavic 3 Classic\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.00.0800\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"DJI\",\"product\":\"Mavic 3 Pro\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.01.0700\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"DJI\",\"product\":\"Mavic 4 Pro\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.00.0500\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"DJI\",\"product\":\"Mini 2\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.07.0200\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"DJI\",\"product\":\"Mini 3\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.00.0500\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"DJI\",\"product\":\"Mini 3 Pro\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.00.0900\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"DJI\",\"product\":\"Mini 4 Pro\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.00.1100\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"DJI\",\"product\":\"Mini 5 Pro\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"01.00.0600\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"5a6e4751-2f3f-4070-9419-94fb35b644e8\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"5a6e4751-2f3f-4070-9419-94fb35b644e8\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-306\"}]}],\"references\":[{\"url\":\"https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en\",\"source\":\"5a6e4751-2f3f-4070-9419-94fb35b644e8\"}]}}"
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.