High severity · published Aug 24, 2026
CVE-2026-78255
DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator's routines.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A3
Air 3 · DJI
through 01.00.1600, · source: vendor
A3
Air 3S · DJI
through 01.00.1400 · source: vendor
A2
Avata 2 · DJI
through 01.00.0400 · source: vendor
A3
Avata 360 · DJI
through 01.00.0300 · source: vendor
FL
Flip · DJI
through 01.00.1200 · source: vendor
M3
Mavic 3 · DJI
through 01.00.1400 · source: vendor
M3
Mavic 3 Classic · DJI
through 01.00.0800 · source: vendor
M3
Mavic 3 Pro · DJI
through 01.01.0700 · source: vendor
M4
Mavic 4 Pro · DJI
through 01.00.0500 · source: vendor
M2
Mini 2 · DJI
through 01.07.0200 · source: vendor
M3
Mini 3 · DJI
through 01.00.0500 · source: vendor
M3
Mini 3 Pro · DJI
through 01.00.0900 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78255
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78255
support.dji.com
https://support.dji.com/help/content?customId=en-us03400011149&spaceId=34&re=US&lang=en
More from Air 3
9.4
CVE-2026-77812
Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE
9.3
CVE-2026-78251
DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory
8.5
CVE-2026-78306
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
6.0
CVE-2026-78321
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion