CVE-2026-78255

Estado: AplazadaAlta (8.7)—

The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator's routines.

Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 8.7

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.41%
Percentil entre todas las CVEs puntuadas: 33
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1005 Data from Local Systemcollection90 %
Impacto secundarioT1552 Unsecured Credentialscredential access80 %

Acceso remoto sin autenticación a servidor HTTP en red interna (AV:N, PR:N, UI:N). Exfiltración de fotos/vídeos almacenados revelando información sensible (ubicaciones, rutinas). CWE-306 confirma falta de autenticación.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Limit Access to Resource Over Network Filter Network Traffic Update Software Active Directory Configuration Vulnerability Scanning

Tecnologías afectadas (16)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

DJI — AIR 3^AI DJI — AIR 3S^AI DJI — Avata 2^AI DJI — Avata 360^AI DJI — Flip^AI DJI — Mavic 3^AI DJI — Mavic 3 Classic^AI DJI — Mavic 3 PRO^AI DJI — Mavic 4 PRO^AI DJI — Mini 2^AI DJI — Mini 3^AI DJI — Mini 3 PRO^AI DJI — Mini 4 PRO^AI DJI — Mini 5 PRO^AI DJI — NEO^AI DJI — NEO 2^AI

CWE

CWE-306

Referencias

https://support.dji.com/help/content?customId=en-us03400011149&spaceId=34&re=US&lang=en

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-78255",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-78255",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-24T16:31:56.561456Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "affectedData": [
        {
          "vendor": "DJI",
          "product": "Neo",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "01.00.0400"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "DJI",
          "product": "Neo 2",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "01.00.0500"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "DJI",
          "product": "Flip",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "01.00.1200"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "DJI",
          "product": "Air 3",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "01.00.1600,"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "DJI",
          "product": "Air 3S",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "01.00.1400"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "DJI",
          "product": "Avata 2",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "01.00.0400"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "DJI",
          "product": "Avata 360",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "01.00.0300"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "DJI",
          "product": "Mavic 3",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "01.00.1400"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "DJI",
          "product": "Mavic 3 Classic",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "01.00.0800"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "DJI",
          "product": "Mavic 3 Pro",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "01.01.0700"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "DJI",
          "product": "Mavic 4 Pro",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "01.00.0500"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "DJI",
          "product": "Mini 2",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "01.07.0200"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "DJI",
          "product": "Mini 3",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "01.00.0500"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "DJI",
          "product": "Mini 3 Pro",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "01.00.0900"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "DJI",
          "product": "Mini 4 Pro",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "01.00.1100"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "DJI",
          "product": "Mini 5 Pro",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "01.00.0600"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-08-24T08:16:33.967",
  "references": [
    {
      "url": "https://support.dji.com/help/content?customId=en-us03400011149&amp;spaceId=34&amp;re=US&amp;lang=en",
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator's routines.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600."
    }
  ],
  "lastModified": "2026-08-26T16:49:18.760",
  "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
}