CVE-2026-77812 DJI Drone Bluetooth Credential Exposure – Risks, Impact, and Mitigation

CVE-2026-77812: DJI Drone Bluetooth Credential Exposure Analysis

What Is CVE-2026-77812?

Vulnerability Overview

CVE-2026-77812 is a critical security vulnerability affecting multiple DJI drone models. The flaw allows attackers to passively intercept unencrypted Bluetooth Low Energy (BLE) communications between the DJI Fly mobile application and affected drones. During this exchange, sensitive network credentials—including Wi-Fi SSID, Wi-Fi Pre-Shared Key (PSK), and trusted session UUID identifiers—are transmitted in cleartext.

An attacker positioned within BLE radio range can capture these credentials without sending any signals, making the attack completely passive and virtually undetectable. Once obtained, these credentials grant unauthorized access to the drone’s internal Wi-Fi network and enable session hijacking through UUID replay attacks.

Why This Matters for Your Organization

If your organization operates DJI drones for commercial, research, or operational purposes, this vulnerability represents a direct threat to:

• Operational Security: Unauthorized individuals can access and control drone systems remotely
• Data Confidentiality: Sensitive mission data and telemetry transmitted over the drone’s Wi-Fi network can be intercepted and decrypted
• Physical Security: Compromised drones could be redirected, disabled, or used for unauthorized surveillance
• Compliance Risk: Depending on your industry, unpatched vulnerabilities may violate regulatory requirements

The passive nature of this attack means compromise can occur without any warning signs or operational anomalies.

Scope of Impact

This vulnerability affects 16 distinct DJI drone models spanning multiple product lines, from consumer-grade units (DJI Mini series) to professional platforms (DJI Air, Mavic, and Avata series). The widespread impact across DJI’s product portfolio means most organizations operating these devices require immediate action.

Affected DJI Drone Models and Firmware Versions

Complete Product List

The following DJI drone models are confirmed vulnerable to CVE-2026-77812:

Consumer/Prosumer Series:

• DJI Neo
• DJI Neo 2
• DJI Flip
• DJI Mini 2
• DJI Mini 3
• DJI Mini 3 Pro
• DJI Mini 4 Pro
• DJI Mini 5 Pro

Professional Series:

• DJI Air 3
• DJI Air 3S
• DJI Mavic 3
• DJI Mavic 3 Classic
• DJI Mavic 3 Pro
• DJI Mavic 4 Pro

Specialized Series:

• DJI Avata 2
• DJI Avata 360

Vulnerable Firmware Versions by Model

Security teams must verify current firmware versions against this table. Any firmware version at or below the listed version is vulnerable:

How to Check Your Current Firmware

Via DJI Fly Application (Recommended):

1. Launch the DJI Fly app on your mobile device
2. Power on the drone and establish a connection
3. Navigate to Settings → Device → Firmware Version
4. Note the displayed firmware version number
5. Cross-reference against the vulnerability table above

Via Web Interface (For Enterprise Deployments):

If your organization uses DJI FlightHub or enterprise management platforms, access the device management dashboard to view firmware versions across your entire fleet simultaneously.

Documentation Method:

Maintain a spreadsheet of all drone serial numbers, models, and current firmware versions. Update this inventory quarterly and immediately after any firmware updates.

Technical Breakdown: How the Attack Works

DUML Protocol Over Unencrypted BLE

The DJI Universal Markup Language (DUML) is a proprietary protocol used for communication between DJI mobile applications and drone hardware. When a user launches the DJI Fly app and connects to a drone, the following sequence occurs:

1. BLE Discovery Phase: The mobile app scans for nearby BLE devices and identifies the target drone
2. Connection Establishment: The app initiates a BLE connection to the drone’s advertised service
3. Credential Exchange: During the handshake, the app transmits Wi-Fi configuration data to the drone using DUML protocol messages
4. Session Initialization: The drone responds with session identifiers and confirmation messages

The Critical Flaw: All DUML messages exchanged during this process are transmitted without encryption. The BLE connection itself uses standard Bluetooth pairing, but the application-layer DUML protocol does not implement additional encryption for sensitive payloads.

Cleartext Data Exposure Points

An attacker performing passive BLE packet capture will observe the following sensitive information in cleartext:

Wi-Fi SSID (Network Name)

• Typically 1-32 characters
• Identifies the drone’s internal access point
• Allows attacker to target the correct network

Wi-Fi Pre-Shared Key (PSK)

• The WPA2/WPA3 password protecting the drone’s Wi-Fi network
• Usually 8-63 characters
• Sufficient for immediate network access without further authentication

Session UUID Identifier

• A unique token generated per connection session
• Used by the drone to identify trusted devices
• Remains constant across multiple sessions unless manually reset

Additional Metadata

• Drone model and serial number
• Firmware version information
• Supported communication protocols
• Network configuration parameters

Session UUID Replay Mechanism

The drone’s authentication model relies on a flawed assumption: that possession of the session UUID proves the connecting device is legitimate. Here’s how the bypass works:

1. Initial Connection: When a user first connects their phone to a drone, the app generates a session UUID
2. UUID Storage: The drone stores this UUID and marks the device as “trusted”
3. Subsequent Connections: On future connections, the drone accepts any device presenting the same UUID without requiring re-confirmation
4. Attacker Exploitation: By capturing and replaying the UUID, an attacker’s device is treated as trusted, bypassing the physical confirmation prompt

This design assumes the UUID remains secret—an assumption violated by the unencrypted BLE transmission.

Why Credentials Persist Indefinitely

Unlike temporary access tokens that expire after a set period, the Wi-Fi PSK and session UUID remain valid until explicitly changed by the drone operator. This creates a persistent vulnerability window:

• No Automatic Rotation: Credentials do not change based on time or usage patterns
• Manual Reset Required: Only deliberate user action (resetting Wi-Fi settings) invalidates captured credentials
• Long-Term Access: A single passive capture provides indefinite unauthorized network access
• No Audit Trail: The drone does not log when credentials were last changed or accessed

Real-World Attack Scenario

Step-by-Step Exploitation Process

Phase 1: Reconnaissance (Pre-Attack)

An attacker identifies a target organization operating DJI drones. This might occur through:

• Observing drone operations at a facility
• Identifying DJI equipment in public photos or social media
• Researching known drone deployments in a geographic area

The attacker determines which DJI models are in use and researches their known vulnerabilities.

Phase 2: Positioning and Passive Capture (Attack Window)

1. The attacker positions themselves within 100-200 meters of the target drone operator (typical BLE range)
2. The attacker activates a BLE packet sniffer on a laptop or mobile device
3. The legitimate drone operator powers on their drone and launches the DJI Fly app
4. As the app connects to the drone, DUML protocol messages are transmitted over BLE
5. The attacker’s sniffer captures these packets without transmitting any signals
6. The entire capture process takes 5-30 seconds and leaves no trace on the drone or app

Phase 3: Data Extraction

The attacker processes the captured BLE packets using open-source tools:

• Parses DUML protocol structure to identify credential fields
• Extracts Wi-Fi SSID, PSK, and session UUID in cleartext
• Stores credentials for later use

Phase 4: Unauthorized Network Access

1. The attacker moves to a location with line-of-sight to the drone (or within Wi-Fi range)
2. Using a standard Wi-Fi client (laptop, phone, or specialized device), the attacker connects to the drone’s Wi-Fi network using the captured PSK
3. The drone’s Wi-Fi access point accepts the connection
4. The attacker is now on the drone’s internal network

Phase 5: Session UUID Replay and Authentication Bypass

1. The attacker attempts to access drone services (typically on ports 8000-8080)
2. The service requests a valid session UUID for authentication
3. The attacker provides the captured UUID
4. The drone’s authentication system recognizes the UUID as “trusted” and grants access
5. The physical confirmation prompt that would normally appear on the legitimate operator’s phone is bypassed

Phase 6: Post-Exploitation

With network access and authentication bypass achieved, the attacker can:

• Access telemetry and flight logs
• Intercept and decrypt Wi-Fi traffic between the legitimate operator and drone
• Send unauthorized commands to the drone
• Modify drone settings or firmware
• Establish persistent backdoor access

Tools Required by Attackers

Passive BLE Sniffing:

• Ubertooth One (~$100): Purpose-built BLE sniffer
• HackRF One (~$300): Software-defined radio capable of BLE capture
• Bluetooth Adapter + Wireshark: Standard laptop Bluetooth adapter with packet capture drivers
• Mobile Apps: Android apps like “BLE Scanner” or “nRF Connect” can capture BLE advertisements

DUML Protocol Parsing:

• Custom Python scripts (publicly available on GitHub)
• Reverse-engineered protocol documentation
• Open-source DJI protocol analyzers

Wi-Fi Network Access:

• Standard laptop or mobile device with Wi-Fi capability
• No specialized equipment required

Post-Exploitation:

• Network reconnaissance tools (nmap, netstat)
• Web browsers for accessing drone web interfaces
• Custom scripts for sending drone commands

Post-Exploitation Capabilities

Once an attacker gains network access to a compromised drone, the following actions become possible:

Detection Blind Spots

The passive nature of this attack creates significant detection challenges:

During Credential Capture:

• No network traffic is generated by the attacker
• No connection attempts are logged on the drone
• No anomalies appear in the DJI Fly app
• Standard Wi-Fi monitoring cannot detect BLE sniffing
• RF monitoring requires specialized equipment

During Unauthorized Access:

• Multiple simultaneous Wi-Fi connections may not trigger alerts
• Unrecognized MAC addresses might be attributed to interference
• Session UUID replay appears as legitimate device reconnection
• Access logs may not distinguish between authorized and unauthorized sessions

Threat Assessment and Risk Level

CVSS Severity Rating

CVSS v3.1 Score: 8.1 (High)

Temporal Score Adjustment: 8.5 (Critical)

The temporal score increases due to:

• Proof of Concept Available: Attack methodology is well-documented
• Active Exploitation: Real-world attacks have been observed
• Widespread Vulnerability: Affects 16 different drone models
• Slow Patch Adoption: Many organizations have not yet updated firmware

Attack Complexity and Requirements

Attacker Requirements:

Organizational Vulnerabilities:

Organizations are at higher risk if they:

• Operate drones in areas with untrusted personnel nearby
• Do not regularly update firmware
• Lack monitoring of drone network activity
• Have no incident response procedures for drone compromise
• Operate drones in sensitive locations (government facilities, critical infrastructure)

Confidentiality, Integrity, and Availability Impact

Confidentiality (High Impact)

• Credential Exposure: Wi-Fi PSK and session UUID captured in cleartext
• Data Interception: All Wi-Fi traffic between operator and drone can be monitored
• Telemetry Access: Flight logs, GPS coordinates, and sensor data become accessible
• Mission Information: Operational plans and objectives may be inferred from flight patterns

Integrity (High Impact)

• Unauthorized Commands: Attacker can send flight commands to the drone
• Settings Modification: Wi-Fi credentials, safety parameters, and operational limits can be changed
• Firmware Tampering: Malicious firmware could be installed for persistent access
• Data Manipulation: Flight logs and telemetry could be altered or deleted

Availability (High Impact)

• Session Hijacking: Legitimate operator’s connection can be disrupted
• Denial of Service: Drone can be forced offline or into safe mode
• Physical Disruption: Drone could be commanded to land, return home, or crash
• Operational Downtime: Compromised drones must be taken offline for investigation and remediation

Why Passive Sniffing Makes This Critical

The passive nature of this attack elevates its severity significantly:

1. No Detection During Capture: Traditional security monitoring cannot detect passive RF sniffing
2. No Forensic Evidence: Attackers leave no logs or network traces during credential harvesting
3. Unlimited Attempts: Attackers can repeatedly sniff credentials without risk of detection
4. Scalability: A single attacker can compromise multiple drones in sequence
5. Persistent Access: Captured credentials remain valid indefinitely
6. Plausible Deniability: Attackers can access drones without leaving obvious signs of compromise

Detection and Monitoring Strategies

Why Traditional Logging Fails

Standard security monitoring approaches are ineffective against this vulnerability:

Host-Based Logging (Drone-Side)

• The drone does not log BLE packet captures
• Passive sniffing generates no connection attempts to log
• Credential exposure occurs before any network connection is established
• Drone firmware has limited logging capabilities

Network-Based Logging (Wi-Fi-Side)

• Passive BLE sniffing occurs on a separate radio interface
• Wi-Fi logs only capture traffic after connection is established
• Session UUID replay appears as legitimate device reconnection
• Multiple simultaneous connections may not trigger alerts

Application Logging (DJI Fly App)

• The app does not log BLE packet contents
• No indication that credentials were exposed during transmission
• App cannot detect external BLE sniffing
• Logs only show successful connections, not attempted attacks

Wi-Fi Network Monitoring Techniques

Active Connection Monitoring

Implement continuous monitoring of the drone’s Wi-Fi access point:

Monitor for:
- Unexpected MAC addresses connecting to drone Wi-Fi
- Multiple simultaneous connections from different devices
- Connections from devices outside your organization's MAC address whitelist
- Connection attempts during periods when drone should be offline
- Rapid connection/disconnection patterns (potential scanning activity)

Tools and Implementation:

• Ubiquiti UniFi: Enterprise Wi-Fi controller with detailed client tracking
• Aruba Instant On: Cloud-based Wi-Fi management with anomaly detection
• Custom Scripts: Python-based monitoring using drone’s Wi-Fi API
• SIEM Integration: Forward drone Wi-Fi logs to central security platform

Baseline Establishment:

1. Document all authorized devices that connect to each drone
2. Record their MAC addresses and connection patterns
3. Establish normal connection frequency and duration
4. Alert on deviations from baseline

RF Signal Analysis for Anomalies

Bluetooth Signal Monitoring

Deploy RF monitoring to detect unauthorized BLE sniffing activity:

Passive RF Monitoring:

• Monitor for BLE devices in proximity to drone operations
• Identify unknown BLE devices attempting to scan for drones
• Detect unusual BLE traffic patterns or packet rates
• Track RF signal strength to estimate attacker proximity

Tools:

• Ubertooth One: Dedicated BLE monitoring and analysis
• HackRF + GNU Radio: Software-defined radio analysis
• Bluetooth Direction Finding: Locate source of BLE signals
• RF Spectrum Analyzers: Identify unauthorized transmissions

Wi-Fi Signal Monitoring

Monitor the drone’s Wi-Fi network for unauthorized access attempts:

Detection Indicators:
- Probe requests from unknown devices
- Deauthentication attacks or frame injection
- Unusual Wi-Fi channel switching
- Signal strength anomalies suggesting nearby rogue access points
- Repeated connection attempts with different credentials

Indicators of Post-Exploitation Activity

Network-Level Indicators

Monitor for these signs of active compromise:

Behavioral Indicators

• Drone executing commands not issued by operator
• Unexpected flight patterns or waypoint changes
• Drone returning to home when not commanded
• Telemetry data inconsistencies
• Drone entering safe mode unexpectedly

Operational Indicators

• Operator reports inability to connect to drone
• Multiple devices claiming to be the same drone
• Drone appearing offline then reconnecting
• Unusual battery drain patterns
• Increased error messages in DJI Fly app

Immediate Mitigation Actions

Firmware Update Procedure by Model

DJI Mini Series (Mini 2, Mini 3, Mini 3 Pro, Mini 4 Pro, Mini 5 Pro)

1. Preparation

• Ensure drone battery is fully charged
• Connect mobile device to stable Wi-Fi network
• Close all other applications
• Disable VPN or proxy connections

1. Update Process

• Launch DJI Fly app
• Power on drone and establish connection
• Navigate to Settings → Device → Firmware Update
• Select Check for Updates
• If update available, select Update
• Do NOT disconnect or power off during update (typically 10-15 minutes)
• Wait for completion confirmation

1. Verification

• Confirm new firmware version in Settings
• Perform test flight to verify normal operation
• Check that all features function correctly

DJI Air Series (Air 3, Air 3S)

1. Preparation

• Charge both drone and remote controller fully
• Ensure mobile device has sufficient storage (500MB+)
• Connect to 5GHz Wi-Fi network if available

1. Update Process

• Launch DJI Fly app
• Power on remote controller, then drone
• Tap Settings → Device → Firmware Update
• Select Check for Updates
• Tap Update when prompted
• Monitor progress bar (typically 15-20 minutes)
• Allow drone to complete update cycle

1. Post-Update

• Verify firmware version matches patched version from table
• Recalibrate compass if prompted
• Test all operational modes

DJI Mavic Series (Mavic 3, Mavic 3 Classic, Mavic 3 Pro, Mavic 4 Pro)

1. Preparation

• Fully charge drone and remote controller
• Ensure 2GB+ free storage on mobile device
• Use 5GHz Wi-Fi for faster download

1. Update Process

• Open DJI Fly app
• Power on remote controller and drone
• Navigate to Settings → Device → Firmware Update
• Tap Check for Updates
• Select Update (Mavic series updates typically take 20-30 minutes)
• Keep app open and device powered on throughout process

1. Verification

• Confirm firmware version in device settings
• Perform gimbal calibration if prompted
• Test camera and recording functions

DJI Avata Series (Avata 2, Avata 360)

1. Preparation

• Charge drone and goggles fully
• Ensure mobile device has 1GB+ free storage
• Connect to strong Wi-Fi signal

1. Update Process

• Launch DJI Fly app
• Power on goggles and drone
• Access Settings → Device → Firmware Update
• Check for updates and select Update
• Allow 15-25 minutes for completion
• Do not disconnect during process

1. Post-Update

• Verify new firmware version
• Test FPV flight mode
• Confirm video transmission quality

DJI Neo Series (Neo, Neo 2)

1. Preparation

• Charge drone fully
• Ensure mobile device has 300MB+ free space
• Use 2.4GHz or 5GHz Wi-Fi

1. Update Process

• Open DJI Fly app
• Power on drone
• Tap Settings → Device → Firmware Update
• Select Check for Updates
• Tap Update (typically 5-10 minutes for Neo series)
• Keep device connected throughout

1. Verification

• Confirm updated firmware version
• Perform short test flight

DJI Flip

1. Preparation

• Fully charge drone
• Ensure 500MB+ free storage on mobile device
• Connect to reliable Wi-Fi

1. Update Process

• Launch DJI Fly app
• Power on drone
• Navigate to Settings → Device → Firmware Update
• Check for updates and select Update
• Allow 10-15 minutes for completion

1. Verification

• Confirm firmware version matches patched release
• Test flight operations

Temporary Workarounds and Limitations

Important: These workarounds provide only temporary relief and do NOT fully resolve the vulnerability.

Manual Wi-Fi Credential Reset

This invalidates previously captured credentials but does not prevent future exposure:

1. Access drone settings in DJI Fly app
2. Navigate to Wi-Fi Settings
3. Select Reset Wi-Fi
4. Confirm action
5. Drone will generate new Wi-Fi SSID and PSK
6. Reconnect mobile device using new credentials

Limitations:

• New credentials will still be exposed over unencrypted BLE during next connection
• Must be repeated after each drone use (impractical)
• Does not address session UUID replay vulnerability
• Provides only hours to days of protection

Operational Security Practices (Temporary Measures)

While awaiting firmware updates:

• Minimize BLE Exposure: Avoid powering on drones in untrusted areas
• Controlled Environments: Conduct drone operations only in secure, access-controlled locations
• Operator Vigilance: Monitor for unauthorized Wi-Fi connections to drone
• Frequent Resets: Reset Wi-Fi credentials before each mission (temporary measure only)
• Network Isolation: Operate drones on isolated Wi-Fi networks not connected to critical systems
• Physical Security: Maintain visual line-of-sight and prevent unauthorized personnel proximity

Timeline for Patching

Immediate Actions (Within 24 Hours)

• Identify all affected drones in your inventory
• Verify current firmware versions
• Prioritize drones used in sensitive operations
• Communicate patch requirements to operators

Short-Term Actions (Within 1 Week)

• Update firmware on all drones in controlled environments
• Test updated drones for normal operation
• Document update completion and new firmware versions
• Brief operators on vulnerability and mitigation

Medium-Term Actions (Within 30 Days)

• Complete firmware updates across entire fleet
• Implement Wi-Fi monitoring on drone networks
• Establish baseline of authorized devices
• Conduct security awareness training

Long-Term Actions (Ongoing)

• Monitor for additional DJI vulnerabilities
• Maintain firmware update schedule
• Implement continuous monitoring
• Develop incident response procedures

Long-Term Security Recommendations

Network Segmentation for Drone Operations

Isolated Wi-Fi Network Architecture

Implement network segmentation to limit impact of drone compromise:

Recommended Architecture:

Internet
    ↓
Firewall
    ↓
├─ Corporate Network (Restricted)
├─ Guest Network (Limited)
└─ Drone Operations Network (Isolated)
        ↓
    ├─ Drone Wi-Fi Access Point
    ├─ Operator Mobile Device
    └─ Mission Control Station

Implementation Details:

1. Dedicated Wi-Fi Network

• Create separate SSID for drone operations only
• Use strong WPA3 encryption (or WPA2 if WPA3 unavailable)
• Disable WPS (Wi-Fi Protected Setup)
• Hide SSID broadcast (minor security benefit)

1. Network Isolation

• Restrict drone network from accessing corporate systems
• Block outbound internet access from drone network
• Implement firewall rules limiting drone-to-drone communication
• Monitor all traffic entering/leaving drone network

1. Access Control

• Whitelist authorized operator devices by MAC address
• Require strong authentication for network access
• Implement 802.1X authentication if available
• Log all connection attempts

1. Monitoring and Logging

• Enable Wi-Fi access point logging
• Forward logs to central SIEM
• Alert on unauthorized MAC addresses
• Monitor for unusual traffic patterns

Credential Management Protocols

Wi-Fi Credential Security

Establish procedures for managing drone Wi-Fi credentials:

Credential Generation:

• Use strong, randomly generated PSKs (minimum 32 characters)
• Avoid dictionary words or predictable patterns
• Generate unique credentials for each drone
• Document credentials in secure password manager

Credential Storage:

• Store credentials in encrypted password manager (1Password, LastPass, Bitwarden)
• Restrict access to authorized personnel only
• Implement role-based access control
• Maintain audit log of credential access

Credential Rotation:

• Rotate credentials quarterly or after suspected compromise
• Change credentials when personnel with access leave organization
• Reset credentials after any security incident
• Document all credential changes

Credential Distribution:

• Distribute credentials only to authorized operators
• Use secure channels (encrypted email, password manager sharing)
• Avoid storing credentials in plain text
• Require acknowledgment of receipt

Monitoring and Incident Response Planning

Continuous Monitoring Program

Implement 24/7 monitoring of drone operations:

Monitoring Components:

1. Wi-Fi Access Point Monitoring

• Real-time alerts for unauthorized MAC addresses
• Notification of multiple simultaneous connections
• Logging of all connection/disconnection events
• Traffic volume analysis

1. Behavioral Analysis

• Establish baseline of normal drone operations
• Alert on deviations from baseline
• Monitor for unusual command patterns
• Track flight path anomalies

1. Firmware Integrity Monitoring

• Periodic firmware checksum verification
• Alerts for unexpected firmware changes
• Comparison against known good versions
• Automated rollback procedures

1. RF Monitoring

• Detect unauthorized BLE devices in proximity
• Monitor for Wi-Fi probe requests
• Identify rogue access points
• Track RF signal anomalies

Incident Response Procedures

Develop formal procedures for responding to suspected compromise:

Detection Phase:

• Establish clear indicators of compromise
• Define escalation procedures
• Assign incident response team
• Establish communication protocols

Containment Phase:

• Immediately isolate compromised drone from network
• Disconnect from Wi-Fi
• Prevent further data exfiltration
• Preserve evidence for analysis

Eradication Phase:

• Restore drone to known good firmware version
• Reset all credentials
• Verify integrity of all systems
• Implement additional security controls

Recovery Phase:

• Restore drone to operational status
• Conduct post-incident testing
• Update security procedures based on lessons learned
• Brief stakeholders on incident and response

Post-Incident Phase:

• Conduct root cause analysis
• Implement preventive measures
• Update security policies
• Provide additional training to operators

Vendor Communication and Updates

Establish Vendor Relationship

Maintain proactive communication with DJI regarding security:

Actions:

• Register all drones with DJI for security notifications
• Subscribe to DJI security advisories and bulletins
• Join DJI’s vulnerability disclosure program if available
• Establish contact with DJI technical support

Monitoring for Updates:

• Check DJI website weekly for security advisories
• Monitor DJI social media for announcements
• Subscribe to security mailing lists
• Set calendar reminders for quarterly security reviews

Patch Management:

• Establish formal patch management process
• Test patches in controlled environment before deployment
• Document all patches applied
• Maintain inventory of patch status across fleet

Future Vulnerability Preparedness:

• Assume additional vulnerabilities will be discovered
• Maintain firmware update capability for all drones
• Keep backup firmware versions available
• Establish rapid response procedures for critical vulnerabilities
• Budget for security updates and training

Frequently Asked Questions

Can CVE-2026-77812 be exploited remotely over the internet?

No. This vulnerability requires the attacker to be within physical Bluetooth Low Energy (BLE) radio range of the drone. BLE has a typical range of 100-200 meters in open space, but this range is significantly reduced by obstacles, walls, and interference. The attack cannot be conducted remotely over the internet or through Wi-Fi networks. An attacker must be physically present in proximity to the target drone during the connection process.

Does the attacker need to pair with the drone or send active requests to exploit this?

No. The attack is completely passive. The attacker does not need to pair with the drone, send any signals, or interact with the device in any way. The attacker simply listens to the BLE communications between the legitimate DJI Fly application and