DJI vulnerabilities

CVEs per yearBy the year they were published

1. 20249
2. 20251
3. 202611

Newest CVEs

• CVE-2026-114357

  DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)

  DJI · CrystalSky ZS600C

  High7.0
• CVE-2026-114356

  DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization

  DJI · CrystalSky ZS600C

  High7.0
• CVE-2026-114355

  DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root

  DJI · CrystalSky ZS600C

  High8.6
• CVE-2026-114354

  DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root

  DJI · CrystalSky ZS600C

  High8.6
• CVE-2026-114353

  DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution

  DJI · CrystalSky ZS600C

  High7.0
• CVE-2026-78321

  DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion

  DJI · Neo

  Medium6.0
• CVE-2026-78306

  DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution

  DJI · Neo

  High8.5
• CVE-2026-78255

  DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media

  DJI · Neo

  High8.7
• CVE-2026-78251

  DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory

  DJI · Neo

  Critical9.3
• CVE-2026-77812

  Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE

  DJI · Neo

  Critical9.4