CVE-2026-114353High· 7.0▾ TwilightHidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS co…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().
crystalsky_zs600c >= 0.3.9.7 <= 0.6.6.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114354High· 8.6DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
CVE-2026-114355High· 8.6DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root
CVE-2026-114357High· 7.0DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)
CVE-2026-114356High· 7.0DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
CVE-2026-78306High· 8.5DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wirele…
CVE-2026-77812Critical· 9.4DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption