CVE-2026-78306 — DJI DUML Command Injection over Bluetooth POC

Description

DJI drones expose a Bluetooth interface used to establish a connection to the drone's Wi-Fi interface and exchange Wi-Fi credentials.

The Bluetooth interface checks the device's trusted UUID for three commands:

• Get SSID
• Get PSK
• Get MAC address

The remaining commands do not require the same authentication check. As a result, a remote attacker within Bluetooth range may be able to send unauthorized DUML commands to the drone.

Depending on the command, an attacker may be able to modify the drone's configuration, including changing the Wi-Fi password and potentially gaining access to the drone's internal network, enabling or disabling radio interfaces, restarting or powering off the aircraft, resetting configuration, and performing other actions.

The POC provides a command registry that allows the available commands to be tested without modifying the Python source code. The command registry, including the command, receiver, authentication requirements, and description of each command, is defined in commands.json.

Affected Products

DEMO

https://github.com/user-attachments/assets/57f51df2-5160-404c-9fd3-2a3a8b700008

Installation

1. Install the POC

# Clone the repository
git clone https://github.com/Wh02m1/CVE-2026-78306-POC.git
cd CVE-2026-78306-POC

# Create and activate a Python virtual environment
python3 -m venv venv
source venv/bin/activate

# Install dependencies
pip install -r requirements.txt

2. Power on the drone

3. Run the POC

python3 ble_console.py

4. After scan select the Drone SSID

Command Reference

The following commands are registered in commands.json. The POC separates commands into read, configuration, radio-control, reset, system, and parameter operations.

Read Commands

Write Configuration Commands

These operations are classified as danger in the POC and therefore require explicit confirmation before being sent.

Radio Control Commands

The radio-control commands are implemented through the corresponding dji_network handlers.

Reset Commands

The POC marks both operations as dangerous because they modify persistent configuration.

System Commands

Parameter Commands

The POC obtains parameter names from flyc_parameters.txt and provides interactive parameter selection. To add a known parameter that you want to modify or reset, add its name to flyc_parameters.txt. The parameter will then be available for selection when the POC is started.

Adding a Command: Edit commands.json, Not the Code

The menu is generated from commands.json at startup. To add a command, add a new object to a section's commands list. The command will appear the next time the POC is started.

Example:

{
  "label": "GET Channel",
  "cmd_set": "0x07",
  "cmd_id": "0x2c",
  "receiver": "0x07",
  "payload": "",
  "tier": "read",
  "bt_reply": true,
  "note": "wms_evt_get_chan -> wifi_mgmt_get_chan."
}

Command Fields

The default receiver is 0x07 (network:0) and the default sender is 0x02 (mobile:0).

Payload Builders

Interactive payload builders are defined in payload_builders.py.

Available builders include:

• ssid
• psk
• country
• mac
• channel
• bss_type
• power_level
• raw

To add a new builder, implement the function, register it in BUILDERS, and reference its name from commands.json.

Confirmation Screen

Commands classified as danger require explicit confirmation before transmission.

The confirmation screen displays information such as:

──────────────────────────────────────────────────────────────────────
  !!!  DANGEROUS COMMAND  !!!
──────────────────────────────────────────────────────────────────────
 COMMAND    device_reset L1 config
 ROUTE      00/de -> ve_air:1
 PAYLOAD    11 01 00 00 00 00
 DOES       system / FC / gimbal / camera / wifi / sdr config reset
 WARNING    The FC configuration reset can restart the motors.
──────────────────────────────────────────────────────────────────────
 Type YES to send:

The DOES information is taken from the command's note, while additional warnings are taken from the warn field in commands.json.

Parameters

The Change a parameter function provides access to the known configuration parameters listed in flyc_parameters.txt.

A parameter can be selected by name, supplied with a value, converted to the selected little-endian width, and sent using set_cfg_item (0x03/0xf9).

Reset a parameter uses reset_cfg_item (0x03/0xfa) to restore the selected parameter to its firmware default.

Macros

The POC also provides several predefined macros:

The macros are defined separately from the individual command entries.

Files

⚠️ Disclaimer

⚠️ WARNING: This proof of concept is intended strictly for educational, security-research, and authorized penetration-testing purposes.

This POC demonstrates security issues in the DJI Bluetooth/DUML command-handling interface. Some commands can modify device configuration, disable radio interfaces, interrupt connectivity, reboot or power off the aircraft, reset configuration, or delete stored data.

⚠️ Do NOT use this POC against any aircraft, device, network, or system that you do not own or do not have explicit authorization to test.

Some commands may cause data loss, configuration changes, loss of connectivity, device disruption, or other unintended consequences. Testing should only be performed in a controlled environment where the aircraft and surrounding people and property are not at risk.

The authors are not responsible for any damage, data loss, service interruption, aircraft operation, or other consequences resulting from the use or misuse of this POC.

⚠️ By using this POC, you accept responsibility for ensuring that your testing is authorized and complies with all applicable laws, regulations, and responsible-disclosure requirements.