In this research, we discovered a fatal exploit chain in DJI remote control devices, leading to the complete compromise of the security defenses within the DJI remote controller. The DUML (DJI Universal Markup Language) protocol is one of DJI’s core protocols, used for communication between various DJI devices and between different components within DJI devices. Ultimately, by combining five vulnerabilities, we achieved arbitrary code execution capability within the TEE of the DJI RC Plus remote controller and obtained the remote controller’s root key.