important · Bluetooth
Public code lets a nearby client send unauthenticated configuration and disruption commands to 16 DJI drone lines.
Affects
DJI Neo, Flip, Air, Avata, Mavic, and Mini consumer aircraft running embedded flight firmware.
Most BLE-exposed DUML commands require no pairing, trusted UUID, credentials or operator interaction. The released console demonstrates Wi-Fi credential changes, radio disruption, reboot, power-off and configuration resets.
Detail and 2 sources
The held evidence establishes configuration and disruption authority, not a complete mid-flight takeover or arbitrary flight-command path.