CVE-2026-1743

LOW

DJI Mavic Mini, Air, Spark and Mini SE <01.00.0500 - Auth Bypass

Title source: llm
STIX 2.1

Description

A vulnerability has been found in DJI Mavic Mini, Air, Spark and Mini SE up to 01.00.0500. Affected by this vulnerability is an unknown functionality of the component Enhanced Wi-Fi Pairing. The manipulation leads to authentication bypass by capture-replay. The attack must be carried out from within the local network. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5
Core References
Permissions Required, VDB Entry vdb-entry
https://vuldb.com/?id.343674
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.343674
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.741323

Scores

CVSS v3 3.1
EPSS 0.0039
EPSS Percentile 30.1%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-287 CWE-294
Status published
Products (4)
DJI/Air 01.00
DJI/Mavic Mini 01.00
DJI/Mini SE 01.00
DJI/Spark 01.00
Published Feb 02, 2026
Tracked Since Feb 18, 2026