DJI Drone Security Alert: Could Your Drone Be Hacked? What Pilots Need to Know
DJI drones show up everywhere now real estate shoots, farm surveys, construction sites, search and rescue, wedding videos. As these aircraft get more connected, DJI drone security is starting to matter as much as battery health or checking your props before takeoff.
A newly published vulnerability, CVE-2026-78251, involves hardcoded credentials in an FTP service on several DJI aircraft. In plain terms: an attacker who already has access to the drone’s internal network or its USB RNDIS interface could use those credentials to dump files into onboard storage, eating up space and potentially interfering with flight logs, telemetry records and future firmware updates. Sixteen DJI models are listed as affected, spanning the Mini, Mavic, Air, Avata, Neo and Flip lines.
So can a DJI drone actually be hacked? It depends on the specific vulnerability, the model, the firmware version, and how much access an attacker would need in the first place.
What Is the DJI Drone Security Alert?
The recent DJI drone vulnerability disclosures point to weaknesses in software and communication systems. They don’t prove that any DJI drone can be casually taken over from across the internet.
CVE-2026-78251 affects firmware across those 16 models. According to the National Vulnerability Database, an attacker would need existing access to the drone’s internal network or its USB RNDIS interface before they could upload files and exhaust available storage. That, in turn, could stop the aircraft from writing flight records and telemetry properly, and might cause problems with later firmware updates.
That’s a meaningfully different scenario from someone sitting anywhere in the world remotely hijacking your drone mid-flight.
Which DJI Drones Are Affected?
The vulnerability record lists:
- DJI Neo and Neo 2
- DJI Flip
- DJI Air 3 and Air 3S
- DJI Avata 2 and Avata 360
- DJI Mavic 3, Mavic 3 Classic and Mavic 3 Pro
- DJI Mavic 4 Pro
- DJI Mini 2, Mini 3 and Mini 3 Pro
- DJI Mini 4 Pro
- DJI Mini 5 Pro
Affected firmware varies by model. Owning one of these aircraft doesn’t automatically mean your specific drone is running vulnerable firmware.
Could Someone Take Control of Your DJI Drone?
This is usually the real question behind any DJI drone hack headline.
The documented vulnerability doesn’t mean a stranger can reach out and take control of every affected drone from a distance. The attack, as described, requires access to the drone’s internal network or its USB RNDIS interface — not an open internet connection. That’s a much higher bar than a typical remote attack.
Still, the disclosure is worth paying attention to. Modern drones are essentially small connected computers: flight-control software, wireless radios, onboard storage, sensors, companion apps. All of it needs to be secured, the same way a laptop or a smart home device does.
What Should DJI Drone Pilots Do?
Check your firmware. Start by confirming your exact aircraft model and the firmware version it’s currently running.
Install official updates. DJI pushes firmware through its apps and through DJI Assistant 2. Updates often improve stability and functionality, and they can close security gaps too so don’t skip them. Steer clear of unofficial firmware files or modified software, however convenient they look.
Secure everything connected to the drone. The aircraft is only one piece of the system. Your phone or tablet, the DJI app, your remote controller, your computer, and any enterprise drone software all need to stay updated.
Watch physical access. Because some vulnerabilities need access to the aircraft’s internal network or physical ports, don’t let unfamiliar devices or people near your drone and its connected gear without good reason. This matters even more on construction sites, infrastructure projects, industrial facilities and public events, where enterprise drones tend to operate.
What About DJI Enterprise Drones?
For commercial operators, DJI drone security covers more than just the aircraft itself. Enterprise drones routinely collect survey data, thermal imagery, infrastructure photos, construction-site records, geographic data and inspection footage. A security flaw on the drone side can turn into a data problem fast.
DJI points to an independent 2026 assessment by cybersecurity firm OnDefend, which tested the Air 3S and Matrice 4E across software, hardware, firmware and RF systems. The result: zero critical, high or medium-risk findings. That’s a solid result, but it covered specific hardware and software versions during a set testing window; a snapshot, not a permanent guarantee against future vulnerabilities.
Is Your DJI Drone Safe?
There’s no single yes-or-no answer that covers every DJI model. What actually matters is the combination of drone model, firmware version, connection method and the conditions an attacker would need to exploit anything.
These disclosures are a reminder that drone cybersecurity isn’t a one-time checkbox — it needs ongoing attention. DJI maintains a security program and publishes resources on the topic, including a drone security white paper and details on independent assessments.
For most pilots, the practical takeaway is simple: check your firmware, stick to official DJI software, and keep every connected device updated.
Final Takeaway
The latest DJI drone security alert is really just confirmation that drones are connected devices now, and connected devices need cybersecurity as part of normal maintenance.
If you fly a DJI Mini, Mavic, Air, Avata, Neo or Flip, check your exact firmware version and install official updates when they’re released.
Before your next flight, don’t just check your battery. Check your firmware too.
Frequently Asked Questions
Can DJI drones be hacked?
Some vulnerabilities have been publicly documented, but the conditions for exploiting them vary. The latest disclosures don’t mean every DJI drone can be remotely hijacked.
Which DJI drones have security vulnerabilities?
The current NVD record for CVE-2026-78251 lists 16 models, including DJI Mini, Mavic, Air, Avata, Neo and Flip aircraft. Affected firmware versions differ by model.
How do I protect my DJI drone from hacking?
Keep your drone firmware, DJI app and controller software updated, stick to official DJI channels, and don’t give unknown devices physical or network access to your aircraft.
Should I update my DJI drone firmware?
Yes. DJI recommends installing updates when they’re available — they often improve stability and functionality, and can also address security issues.
Can someone hack a DJI drone remotely?
It depends on the vulnerability. CVE-2026-78251 requires access to the drone’s internal network or USB RNDIS interface, so it’s not accurate to describe it as a simple internet-based remote takeover.
Are DJI enterprise drones secure?
Security depends on the specific aircraft, firmware, configuration and environment. DJI has published independent assessments and security resources, but newly discovered vulnerabilities show why continuous updates and good security habits still matter.
