CVE-2026-78251

The FTP service embedded in the firmware of numerous DJI consumer drones uses hardcoded credentials shared across affected models (CWE-798) and permits authenticated users to upload files of unlimited size, count, and total storage to the /blackbox/upgrade/ directory, where existing files can also be overwritten. An attacker who can reach the drone's internal network or its USB RNDIS interface can authenticate with the shared credentials and deliberately fill the onboard storage. Successful abuse prevents the aircraft from writing flight records, logs, and telemetry, may block subsequent firmware updates, and the uploaded files persist across reboot and factory reset, complicating recovery. Sixteen DJI models are affected — the Neo, Neo 2, Flip, Air 3, Air 3S, Avata 2, Avata 360, Mavic 3, Mavic 3 Classic, Mavic 3 Pro, Mavic 4 Pro, Mini 2, Mini 3, Mini 3 Pro, Mini 4 Pro, and Mini 5 Pro — each at firmware versions below the listed fixed builds, with remediation requiring a vendor firmware update. No public proof-of-concept is known, the issue is not in CISA's KEV, and EPSS assigns only a 0.4% probability of exploitation within 30 days, so no in-the-wild exploitation is currently known.

What to do: Update each affected aircraft to at least the listed fixed firmware for its model (e.g., Neo 01.00.0400, Mavic 3 Pro 01.01.0700, Mini 2 01.07.0200) via DJI's official update tooling, and verify the current firmware version in the DJI mobile app. Until updated, avoid connecting affected drones to untrusted Wi-Fi networks and disconnect USB RNDIS links when not in use, since exploitation requires access to the drone's internal network or USB interface. If storage was filled, note that uploaded files persist through reboot and factory reset, so manually clear /blackbox/upgrade/ where possible.