CVE-2026-1743CWE-287CWE-294

DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay

Low · published February 2, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
34.6
In the wild
Unconfirmed
What it is

A vulnerability has been found in DJI Mavic Mini, Air, Spark and Mini SE up to 01.00.0500. Affected by this vulnerability is an unknown functionality of the component Enhanced Wi-Fi Pairing. The manipulation leads to authentication bypass by capture-replay. The attack must be carried out from within the local network. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00414 · 34.6th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-294 · Authentication Bypass by Capture-replay
Published
2026-02-02T04:02Z
EPSS history
Timeline
  • 02 FEB 04:02Z
    DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay
    cvelistv5