CVE-2026-77812

CVE-2026-77812 exposes a DJI BLE authentication system that treats physical proximity as a security boundary—a design choice that collapses the moment an attacker enters the ~100-meter BLE range. The vulnerability isn't a weak cipher; BLE carries no encryption by design, and DJI appears to have treated that geographic limit as the authentication mechanism itself. The CVSS 9.4 rating is misleading because it implies a patch will meaningfully close the attack surface. It won't. The compounding failures are threefold: cleartext credential transmission, a static session UUID as the sole trust indicator, and no credential rotation mechanism. These aren't independent bugs—they reflect a coherent design philosophy where proximity during pairing establishes persistent trust. The DJI Fly app's physical confirmation step was meant to compensate, but the replayable UUID eviscerates that control. An attacker doesn't need to be present at pairing; they need only have been present once during any normal operation. Critically, the remediation channel is the same compromised BLE link. When DJI ships a firmware update introducing rotated credentials or session tokens, those new secrets transmit over the same unencrypted BLE during the update handshake. An attacker observing the update process captures fresh credentials the moment the patch deploys. You rotate; they observe the rotation. There is no clean channel within the current architecture to deliver a fix. The captured credential has indefinite validity. One passive capture creates permanent access unless the operator manually intervenes—a stark inversion of the normal assumption that credentials have bounded lifetimes. The attack surface isn't the moment of connection; it's any moment the drone operates within BLE range, which in urban environments is essentially always. Older models on the affected list—the Mini 2 at firmware 01.07.0200, the Mavic 3 Classic at 01.00.0800—will likely never receive patches. DJI's product lifecycle discipline historically abandons older hardware well before it leaves the field. The CVSS 9.4 implies remediation is available; for a significant portion of the deployed fleet, it isn't. The practical question for defenders: there is no user-side detection mechanism for passive BLE observation, and no firmware update delivered over BLE can constitute genuine remediation while the same protocol carries both the vulnerability and its fix. The architectural failure is not patchable at the firmware layer. Operators flying in populated areas should assume their drone's network is observable and plan operational security accordingly—treating the BLE pairing as a convenience feature with no security guarantee, not a trust boundary.

Reviewed through automated stages and approved by a human before publication.