important · Wi-Fi — DJI
A passive Bluetooth capture of a normal DJI session yields persistent Wi-Fi trust material.
Affects
DJI Neo, Flip, Air, Avata, Mavic and Mini consumer aircraft using DJI Fly and QuickTransfer.
The public parser recovers the aircraft SSID, persistent PSK and trusted-client UUID from captured ATT traffic without pairing or prior trust.
Detail and 4 sources
We do not know which internal management or flight-control services accept those values without another authorization secret.
Chain to watch
Passively recover the SSID, PSK and trusted-client UUID during an ordinary DJI connection exchange.→↓Join the aircraft network with those values and trace authentication at each internal service.→↓Which services accept the recovered trust material without another credential.
Unverified chainEnumerate the internal services while tracing requests for session-, account- or controller-bound authorization.
Sources