DJ
Vendor
DJI
176
CVEs
0
On KEV
5
New 30D
Products
CZ9.3
CrystalSky ZS600C
DJI
5 CVEs0 on KEV5 new
M39.4
Mini 3 Pro
DJI
14 CVEs0 on KEV0 new
M39.4
Mavic 3
DJI
12 CVEs0 on KEV0 new
M39.4
Mavic 3 Classic
DJI
12 CVEs0 on KEV0 new
M39.4
Mavic 3 Pro
DJI
12 CVEs0 on KEV0 new
M36.8
Matrice 300
DJI
7 CVEs0 on KEV0 new
MM6.8
Matrice M30
DJI
7 CVEs0 on KEV0 new
M36.8
Mavic 3 Enterprise
DJI
7 CVEs0 on KEV0 new
A39.4
Air 3
DJI
5 CVEs0 on KEV0 new
A39.4
Air 3S
DJI
5 CVEs0 on KEV0 new
A29.4
Avata 2
DJI
5 CVEs0 on KEV0 new
A39.4
Avata 360
DJI
5 CVEs0 on KEV0 new
M49.4
Mavic 4 Pro
DJI
5 CVEs0 on KEV0 new
M29.4
Mini 2
DJI
5 CVEs0 on KEV0 new
M39.4
Mini 3
DJI
5 CVEs0 on KEV0 new
M49.4
Mini 4 Pro
DJI
5 CVEs0 on KEV0 new
M59.4
Mini 5 Pro
DJI
5 CVEs0 on KEV0 new
NE9.4
Neo
DJI
5 CVEs0 on KEV0 new
N29.4
Neo 2
DJI
5 CVEs0 on KEV0 new
FL9.3
Flip
DJI
4 CVEs0 on KEV0 new
M37.5
Mavic 3 Firmware
Dji
4 CVEs0 on KEV0 new
M36.8
Mini 3 Pro Firmware
Dji
4 CVEs0 on KEV0 new
M36.8
Matrice 300 Firmware
Dji
3 CVEs0 on KEV0 new
MM6.8
Matrice M30 Firmware
Dji
3 CVEs0 on KEV0 new
M36.8
Mavic 3 Pro Firmware
Dji
3 CVEs0 on KEV0 new
MM5.0
Mavic Mini
DJI
2 CVEs0 on KEV0 new
MS7.5
Mini SE Firmware
Dji
2 CVEs0 on KEV0 new
SF7.5
Spark Firmware
Dji
2 CVEs0 on KEV0 new
AI3.1
Air
DJI
1 CVEs0 on KEV0 new
A27.5
Air 2 Firmware
Dji
1 CVEs0 on KEV0 new
A27.5
Air 2s Firmware
Dji
1 CVEs0 on KEV0 new
DF9.4
DJI Flip
DJI
1 CVEs0 on KEV0 new
F47.5
Fhantom 4 Pro Firmware
Dji
1 CVEs0 on KEV0 new
FF7.5
Fpv Firmware
Dji
1 CVEs0 on KEV0 new
I27.5
Inspire 2 Firmware
Dji
1 CVEs0 on KEV0 new
M27.8
Mavic 2 Firmware
Dji
1 CVEs0 on KEV0 new
MA5.0
Mavic Air
DJI
1 CVEs0 on KEV0 new
MM7.5
Mavic Mini Firmware
Dji
1 CVEs0 on KEV0 new
MS5.0
Mavic Spark
DJI
1 CVEs0 on KEV0 new
M27.5
Mini 2 Firmware
Dji
1 CVEs0 on KEV0 new
MS3.1
Mini SE
DJI
1 CVEs0 on KEV0 new
NP–
Newsbin Pro
Dji
1 CVEs0 on KEV0 new
RP7.5
RC Pro Firmware
Dji
1 CVEs0 on KEV0 new
SP3.1
Spark
DJI
1 CVEs0 on KEV0 new
ZX7.5
Zenmuse X5s Firmware
Dji
1 CVEs0 on KEV0 new
ZX7.5
Zenmuse X7 Firmware
Dji
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114357 New | CZ CrystalSky ZS600C DJI | 9.3 | Oct 23 | DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0) |
| CVE-2026-114356 New | CZ CrystalSky ZS600C DJI | 7.0 | Oct 23 | DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization |
| CVE-2026-114355 New | CZ CrystalSky ZS600C DJI | 8.6 | Oct 23 | DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root |
| CVE-2026-114354 New | CZ CrystalSky ZS600C DJI | 8.6 | Oct 23 | DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root |
| CVE-2026-114353 New | CZ CrystalSky ZS600C DJI | 7.0 | Oct 23 | DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution |
| CVE-2026-78321 | N2 Neo 2 DJI | 6.0 | Aug 24 | DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion |
| CVE-2026-78306 | FL Flip DJI | 8.5 | Aug 24 | DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution |
| CVE-2026-78255 | M4 Mini 4 Pro DJI | 8.7 | Aug 24 | DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media |
| CVE-2026-78251 | NE Neo DJI | 9.3 | Aug 24 | DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory |
| CVE-2026-77812 | N2 Neo 2 DJI | 9.4 | Aug 21 | Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE |
| CVE-2026-26673 | MM Mavic Mini Firmware Dji | 7.5 | Mar 4 | An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via the DJI Enhanced-WiFi transmission… |
| CVE-2026-1743 | MM Mavic Mini DJI | 3.1 | Feb 2 | DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay |
| CVE-2025-10250 | MM Mavic Mini DJI | 5.0 | Sep 11 | DJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded key |
| CVE-2023-51456 | M3 Mini 3 Pro DJI | 6.8 | Apr 2 | A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to trigger an out-of-bound… |
| CVE-2023-51455 | M3 Mavic 3 Pro DJI | 6.8 | Apr 2 | A Improper Validation of Array Index issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to corrupt a controlled… |
| CVE-2023-51454 | M3 Mavic 3 DJI | 6.8 | Apr 2 | A Out-of-bounds Write issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to overwrite a pointer in the process… |
| CVE-2023-51453 | MM Matrice M30 DJI | 3.0 | Apr 2 | A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash of the service… |
| CVE-2023-51452 | M3 Mavic 3 Classic DJI | 3.0 | Apr 2 | A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash of the service… |
| CVE-2023-6951 | M3 Matrice 300 DJI | 6.6 | Apr 2 | A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate… |
| CVE-2023-6950 | M3 Mini 3 Pro DJI | 3.0 | Apr 2 | An Improper Input Validation vulnerability affecting the FTP service running on the DJI Mavic Mini 3 Pro could allow an attacker to craft a malicious packet containing a malformed… |
| CVE-2023-6949 | M3 Mini 3 Pro DJI | 5.2 | Apr 2 | A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an attacker to enumerate… |
| CVE-2023-6948 | M3 Mavic 3 Pro DJI | 3.0 | Apr 2 | A Buffer Copy without Checking Size of Input issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash of… |
| CVE-2022-46415 | SF Spark Firmware Dji | 5.9 | Mar 27 | DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool |
| CVE-2022-29945 | MS Mini SE Firmware Dji | 7.5 | Apr 29 | DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol |
| CVE-2020-29664 | M2 Mavic 2 Firmware Dji | 7.8 | Feb 18 | A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a malicious firmware upgrade packet |
| CVE-2007-1074 | NP Newsbin Pro Dji | – | Feb 22 | Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted remote attackers to execute arbitrary code via a long (1) DataPath or (2) DownloadPath… |