DJ
Vendor
DJI
109
CVEs
0
On KEV
5
New 30D
Products
CZ9.3
CrystalSky ZS600C
DJI
5 CVEs0 on KEV5 new
A39.4
Air 3
DJI
5 CVEs0 on KEV0 new
A39.4
Air 3S
DJI
5 CVEs0 on KEV0 new
A29.4
Avata 2
DJI
5 CVEs0 on KEV0 new
A39.4
Avata 360
DJI
5 CVEs0 on KEV0 new
M39.4
Mavic 3
DJI
5 CVEs0 on KEV0 new
M39.4
Mavic 3 Classic
DJI
5 CVEs0 on KEV0 new
M39.4
Mavic 3 Pro
DJI
5 CVEs0 on KEV0 new
M49.4
Mavic 4 Pro
DJI
5 CVEs0 on KEV0 new
M29.4
Mini 2
DJI
5 CVEs0 on KEV0 new
M39.4
Mini 3
DJI
5 CVEs0 on KEV0 new
M39.4
Mini 3 Pro
DJI
5 CVEs0 on KEV0 new
M49.4
Mini 4 Pro
DJI
5 CVEs0 on KEV0 new
M59.4
Mini 5 Pro
DJI
5 CVEs0 on KEV0 new
NE9.4
Neo
DJI
5 CVEs0 on KEV0 new
N29.4
Neo 2
DJI
5 CVEs0 on KEV0 new
FL9.3
Flip
DJI
4 CVEs0 on KEV0 new
MM5.0
Mavic Mini
DJI
2 CVEs0 on KEV0 new
MS7.5
Mini SE Firmware
Dji
2 CVEs0 on KEV0 new
SF7.5
Spark Firmware
Dji
2 CVEs0 on KEV0 new
AI3.1
Air
DJI
1 CVEs0 on KEV0 new
A27.5
Air 2 Firmware
Dji
1 CVEs0 on KEV0 new
A27.5
Air 2s Firmware
Dji
1 CVEs0 on KEV0 new
DF9.4
DJI Flip
DJI
1 CVEs0 on KEV0 new
F47.5
Fhantom 4 Pro Firmware
Dji
1 CVEs0 on KEV0 new
FF7.5
Fpv Firmware
Dji
1 CVEs0 on KEV0 new
I27.5
Inspire 2 Firmware
Dji
1 CVEs0 on KEV0 new
M27.8
Mavic 2 Firmware
Dji
1 CVEs0 on KEV0 new
M37.5
Mavic 3 Firmware
Dji
1 CVEs0 on KEV0 new
MA5.0
Mavic Air
DJI
1 CVEs0 on KEV0 new
MM7.5
Mavic Mini Firmware
Dji
1 CVEs0 on KEV0 new
MS5.0
Mavic Spark
DJI
1 CVEs0 on KEV0 new
M27.5
Mini 2 Firmware
Dji
1 CVEs0 on KEV0 new
MS3.1
Mini SE
DJI
1 CVEs0 on KEV0 new
NP–
Newsbin Pro
Dji
1 CVEs0 on KEV0 new
RP7.5
RC Pro Firmware
Dji
1 CVEs0 on KEV0 new
SP3.1
Spark
DJI
1 CVEs0 on KEV0 new
ZX7.5
Zenmuse X5s Firmware
Dji
1 CVEs0 on KEV0 new
ZX7.5
Zenmuse X7 Firmware
Dji
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114357 New | CZ CrystalSky ZS600C DJI | 9.3 | Oct 23 | DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0) |
| CVE-2026-114356 New | CZ CrystalSky ZS600C DJI | 7.0 | Oct 23 | DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization |
| CVE-2026-114355 New | CZ CrystalSky ZS600C DJI | 8.6 | Oct 23 | DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root |
| CVE-2026-114354 New | CZ CrystalSky ZS600C DJI | 8.6 | Oct 23 | DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root |
| CVE-2026-114353 New | CZ CrystalSky ZS600C DJI | 7.0 | Oct 23 | DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution |
| CVE-2026-78321 | M3 Mavic 3 DJI | 6.0 | Aug 24 | DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion |
| CVE-2026-78306 | M3 Mini 3 Pro DJI | 8.5 | Aug 24 | DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution |
| CVE-2026-78255 | FL Flip DJI | 8.7 | Aug 24 | DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media |
| CVE-2026-78251 | A3 Air 3S DJI | 9.3 | Aug 24 | DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory |
| CVE-2026-77812 | NE Neo DJI | 9.4 | Aug 21 | Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE |
| CVE-2026-26673 | MM Mavic Mini Firmware Dji | 7.5 | Mar 4 | An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via the DJI Enhanced-WiFi transmission… |
| CVE-2026-1743 | MS Mini SE DJI | 3.1 | Feb 2 | DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay |
| CVE-2025-10250 | MA Mavic Air DJI | 5.0 | Sep 11 | DJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded key |
| CVE-2022-46415 | SF Spark Firmware Dji | 5.9 | Mar 27 | DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool |
| CVE-2022-29945 | M2 Mini 2 Firmware Dji | 7.5 | Apr 29 | DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol |
| CVE-2020-29664 | M2 Mavic 2 Firmware Dji | 7.8 | Feb 18 | A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a malicious firmware upgrade packet |
| CVE-2007-1074 | NP Newsbin Pro Dji | – | Feb 22 | Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted remote attackers to execute arbitrary code via a long (1) DataPath or (2) DownloadPath… |