Search
Find a vulnerability
Search criteria
10 vulnerabilities found for CrystalSky ZS600C by DJI
CVE-2026-114357 (GCVE-0-2026-114357)
Vulnerability from nvd – Published: 2026-10-23 13:39 – Updated: 2026-10-23 13:39
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)
Summary
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).
Severity
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or \u0027setprop persist.adb.tcp.port 5555\u0027), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).\u003c/p\u003e"
}
],
"value": "Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or \u0027setprop persist.adb.tcp.port 5555\u0027), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3)."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Unauthenticated shell over USB by default (and over the network if ADB-over-TCP is enabled); foothold for escalation to root."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "ADB-over-TCP enabled (non-default): network-reachable"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:39:28.510Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114357",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114357"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114357",
"datePublished": "2026-10-23T13:39:28.510Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:39:28.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114356 (GCVE-0-2026-114356)
Vulnerability from nvd – Published: 2026-10-23 13:37 – Updated: 2026-10-23 13:37
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
Summary
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authorization in the system-privileged \u0027DJIUpdateService\u0027 binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.\u003c/p\u003e"
}
],
"value": "Missing authorization in the system-privileged \u0027DJIUpdateService\u0027 binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Local zero-permission application triggers destructive privileged operations (factory reset/wipe, shutdown) and the firmware-apply hand-off."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:37:34.059Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114356",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114356"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114356",
"datePublished": "2026-10-23T13:37:34.059Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:37:34.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114355 (GCVE-0-2026-114355)
Vulnerability from nvd – Published: 2026-10-23 13:35 – Updated: 2026-10-23 13:35
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root
Summary
OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.
Severity
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOS command injection in the root-privileged \u0027hardware_monitor\u0027 helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.\u003c/p\u003e"
}
],
"value": "OS command injection in the root-privileged \u0027hardware_monitor\u0027 helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Local unprivileged process escalates to root via attacker-controlled log content."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:35:42.796Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114355",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114355"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114355",
"datePublished": "2026-10-23T13:35:42.796Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:35:42.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114354 (GCVE-0-2026-114354)
Vulnerability from nvd – Published: 2026-10-23 13:33 – Updated: 2026-10-23 13:33
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
Summary
Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authorization in the native binder service \u0027android.dji.server\u0027 (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged \u0027assistant\u0027 daemon without any caller-identity or permission check.\u003c/p\u003e"
}
],
"value": "Missing authorization in the native binder service \u0027android.dji.server\u0027 (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged \u0027assistant\u0027 daemon without any caller-identity or permission check."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Local zero-permission application gains arbitrary command execution as root."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:33:36.131Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114354",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114354"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114354",
"datePublished": "2026-10-23T13:33:36.131Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:33:36.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114353 (GCVE-0-2026-114353)
Vulnerability from nvd – Published: 2026-10-23 13:31 – Updated: 2026-10-23 13:31
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution
Summary
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().
Severity
CWE
- CWE-912 - Hidden Functionality
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eHidden functionality (undocumented backdoor) in the root-privileged \u0027assistant\u0027 daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string \u0027dji26656677\u0027 to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().\u003c/p\u003e"
}
],
"value": "Hidden functionality (undocumented backdoor) in the root-privileged \u0027assistant\u0027 daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string \u0027dji26656677\u0027 to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system()."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Unauthenticated root-level command execution over the USB serial interface."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:31:05.598Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114353",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114353"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114353",
"datePublished": "2026-10-23T13:31:05.598Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:31:05.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114357 (GCVE-0-2026-114357)
Vulnerability from cvelistv5 – Published: 2026-10-23 13:39 – Updated: 2026-10-23 13:39
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)
Summary
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).
Severity
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or \u0027setprop persist.adb.tcp.port 5555\u0027), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).\u003c/p\u003e"
}
],
"value": "Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or \u0027setprop persist.adb.tcp.port 5555\u0027), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3)."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Unauthenticated shell over USB by default (and over the network if ADB-over-TCP is enabled); foothold for escalation to root."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "ADB-over-TCP enabled (non-default): network-reachable"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:39:28.510Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114357",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114357"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114357",
"datePublished": "2026-10-23T13:39:28.510Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:39:28.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114356 (GCVE-0-2026-114356)
Vulnerability from cvelistv5 – Published: 2026-10-23 13:37 – Updated: 2026-10-23 13:37
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
Summary
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authorization in the system-privileged \u0027DJIUpdateService\u0027 binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.\u003c/p\u003e"
}
],
"value": "Missing authorization in the system-privileged \u0027DJIUpdateService\u0027 binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Local zero-permission application triggers destructive privileged operations (factory reset/wipe, shutdown) and the firmware-apply hand-off."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:37:34.059Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114356",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114356"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114356",
"datePublished": "2026-10-23T13:37:34.059Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:37:34.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114355 (GCVE-0-2026-114355)
Vulnerability from cvelistv5 – Published: 2026-10-23 13:35 – Updated: 2026-10-23 13:35
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root
Summary
OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.
Severity
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOS command injection in the root-privileged \u0027hardware_monitor\u0027 helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.\u003c/p\u003e"
}
],
"value": "OS command injection in the root-privileged \u0027hardware_monitor\u0027 helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Local unprivileged process escalates to root via attacker-controlled log content."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:35:42.796Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114355",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114355"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114355",
"datePublished": "2026-10-23T13:35:42.796Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:35:42.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114354 (GCVE-0-2026-114354)
Vulnerability from cvelistv5 – Published: 2026-10-23 13:33 – Updated: 2026-10-23 13:33
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
Summary
Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authorization in the native binder service \u0027android.dji.server\u0027 (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged \u0027assistant\u0027 daemon without any caller-identity or permission check.\u003c/p\u003e"
}
],
"value": "Missing authorization in the native binder service \u0027android.dji.server\u0027 (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged \u0027assistant\u0027 daemon without any caller-identity or permission check."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Local zero-permission application gains arbitrary command execution as root."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:33:36.131Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114354",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114354"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114354",
"datePublished": "2026-10-23T13:33:36.131Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:33:36.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114353 (GCVE-0-2026-114353)
Vulnerability from cvelistv5 – Published: 2026-10-23 13:31 – Updated: 2026-10-23 13:31
VLAI
EPSS
VEX
Title
DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution
Summary
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().
Severity
CWE
- CWE-912 - Hidden Functionality
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cyber-defence-campus.github.io/projects/v… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DJI | CrystalSky ZS600C |
Affected:
0.3.9.7 , ≤ 0.6.6.9
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CrystalSky ZS600C",
"vendor": "DJI",
"versions": [
{
"lessThanOrEqual": "0.6.6.9",
"status": "affected",
"version": "0.3.9.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloren\u00e7 Rom\u00e1 Alvarez, Security Researcher, Cyber Defence Campus, Switzerland"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eHidden functionality (undocumented backdoor) in the root-privileged \u0027assistant\u0027 daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string \u0027dji26656677\u0027 to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().\u003c/p\u003e"
}
],
"value": "Hidden functionality (undocumented backdoor) in the root-privileged \u0027assistant\u0027 daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string \u0027dji26656677\u0027 to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system()."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Unauthenticated root-level command execution over the USB serial interface."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:31:05.598Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "CVE-2026-114353",
"tags": [
"third-party-advisory"
],
"url": "https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114353"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-114353",
"datePublished": "2026-10-23T13:31:05.598Z",
"dateReserved": "2026-10-21T08:41:14.430Z",
"dateUpdated": "2026-10-23T13:31:05.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}