Dji
16 CVEs across 41 Dji products. Browse Dji vulnerabilities, severities, and proof-of-concept exploits.
Dji products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-26673 | High | 7.5 | 2026-03-04 | An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via the DJI Enhanced-Wi… |
CVE-2026-1743 | Low | 3.1 | 2026-02-02 | A vulnerability has been found in DJI Mavic Mini, Air, Spark and Mini SE up to 01.00.0500. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2025-10250 | Medium | 5.0 | 2025-09-11 | A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Exe… |
CVE-2023-6951 | Medium | 6.6 | 2024-04-02 | A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key a… |
CVE-2023-6950 | Low | 3.0 | 2024-04-02 | An Improper Input Validation vulnerability affecting the FTP service running on the DJI Mavic Mini 3 Pro could allow an attacker to craft a malicious packet co… |
CVE-2023-6949 | Medium | 5.2 | 2024-04-02 | A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an atta… |
CVE-2023-6948 | Low | 3.0 | 2024-04-02 | A Buffer Copy without Checking Size of Input issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker… |
CVE-2023-51456 | Medium | 6.8 | 2024-04-02 | A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to trigger an ou… |
CVE-2023-51455 | Medium | 6.8 | 2024-04-02 | A Improper Validation of Array Index issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to corr… |
CVE-2023-51454 | Medium | 6.8 | 2024-04-02 | A Out-of-bounds Write issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to overwrite a pointer… |
CVE-2023-51453 | Low | 3.0 | 2024-04-02 | A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash… |
CVE-2023-51452 | Low | 3.0 | 2024-04-02 | A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash… |
CVE-2022-46415 | Critical | 9.1 | 2023-03-27 | DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacke… |
CVE-2022-29945 | Medium | 4.0 | 2022-04-29 | DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol. |
CVE-2020-29664 | High | 7.8 | 2021-02-18 | A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a malicious firmware upg… |
CVE-2007-1074 | | 2007-02-22 | Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted remote attackers to execute arbitrary code via a long (1) DataPath or (2)… |