Skip to content
DJI
Products
| Product | CVEs | Exploited | Latest |
|---|
| Mini 3 Pro | 14 | – | Aug 24, 2026 |
| Mavic 3 | 12 | – | Aug 24, 2026 |
| Mavic 3 Classic | 12 | – | Aug 24, 2026 |
| Mavic 3 Pro | 12 | – | Aug 24, 2026 |
| Matrice M30 | 7 | – | Apr 2, 2024 |
| Mavic 3 Enterprise | 7 | – | Apr 2, 2024 |
| Matrice 300 | 7 | – | Apr 2, 2024 |
| Mini 4 Pro | 5 | – | Aug 24, 2026 |
| Mini 3 | 5 | – | Aug 24, 2026 |
| Neo | 5 | – | Aug 24, 2026 |
| CrystalSky ZS600C | 5 | – | Oct 23, 2026 |
| Air 3 | 5 | – | Aug 24, 2026 |
| Avata 360 | 5 | – | Aug 24, 2026 |
| Neo 2 | 5 | – | Aug 24, 2026 |
| Mini 5 Pro | 5 | – | Aug 24, 2026 |
| Mavic 4 Pro | 5 | – | Aug 24, 2026 |
| Air 3S | 5 | – | Aug 24, 2026 |
| Avata 2 | 5 | – | Aug 24, 2026 |
| Mini 2 | 5 | – | Aug 24, 2026 |
| Flip | 4 | – | Aug 24, 2026 |
| Mavic Mini | 2 | – | Feb 2, 2026 |
| Spark | 1 | – | Feb 2, 2026 |
| DJI Flip | 1 | – | Aug 21, 2026 |
| Mavic Air | 1 | – | Sep 11, 2025 |
| Mavic Spark | 1 | – | Sep 11, 2025 |
| Mini SE | 1 | – | Feb 2, 2026 |
| Air | 1 | – | Feb 2, 2026 |
Exploited and recent CVEs
-
CVE-2026-114357
High 7.0
DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)
0.3%
-
CVE-2026-114356
High 7.0
DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
0.1%
-
CVE-2026-114355
High 8.6
DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root
1.2%
-
CVE-2026-114354
High 8.6
DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
0.1%
-
CVE-2026-114353
High 7.0
DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution
0.2%
-
CVE-2026-78321
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
0.2%
-
CVE-2026-78321
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
0.2%
-
CVE-2026-78321
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
0.2%
-
CVE-2026-78321
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
0.2%
-
CVE-2026-78321
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
0.2%
-
CVE-2026-78321
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
0.2%
-
CVE-2026-78321
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
0.2%
-
CVE-2026-78321
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
0.2%
-
CVE-2026-78321
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
0.2%
-
CVE-2026-78321
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
0.2%
-
CVE-2026-78321
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
0.2%
-
CVE-2026-78321
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
0.2%
-
CVE-2026-78321
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
0.2%
-
CVE-2026-78321
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
0.2%
-
CVE-2026-78321
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
0.2%
-
CVE-2026-78321
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
0.2%
-
CVE-2026-78306
High 8.5
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
0.2%
-
CVE-2026-78306
High 8.5
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
0.2%
-
CVE-2026-78306
High 8.5
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
0.2%
-
CVE-2026-78306
High 8.5
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
0.2%
-
CVE-2026-78306
High 8.5
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
0.2%
-
CVE-2026-78306
High 8.5
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
0.2%
-
CVE-2026-78306
High 8.5
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
0.2%
-
CVE-2026-78306
High 8.5
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
0.2%
-
CVE-2026-78306
High 8.5
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
0.2%