Dji Mavic 3
12 CVEs affecting Dji Mavic 3. Latest disclosed: 2026-08-27. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-51456 | Medium | 6.8 | 2024-04-02 | A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to trigger an ou… |
CVE-2023-51455 | Medium | 6.8 | 2024-04-02 | A Improper Validation of Array Index issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to corr… |
CVE-2023-51454 | Medium | 6.8 | 2024-04-02 | A Out-of-bounds Write issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to overwrite a pointer… |
CVE-2023-6951 | Medium | 6.6 | 2024-04-02 | A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key a… |
CVE-2023-6948 | Low | 3.0 | 2024-04-02 | A Buffer Copy without Checking Size of Input issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker… |
CVE-2023-51453 | Low | 3.0 | 2024-04-02 | A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash… |
CVE-2023-51452 | Low | 3.0 | 2024-04-02 | A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash… |
CVE-2026-78251 | | 2026-08-27 | DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits… | |
CVE-2026-78321 | | 2026-08-24 | The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's interna… | |
CVE-2026-78306 | | 2026-08-24 | DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration paramet… | |
CVE-2026-78255 | | 2026-08-24 | The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames… | |
CVE-2026-77812 | | 2026-08-21 | DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connec… |