CVE-2026-114355High· 8.6▾ TwilightOS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted l…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.
crystalsky_zs600c >= 0.3.9.7 <= 0.6.6.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114354High· 8.6DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
CVE-2026-114353High· 7.0DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution
CVE-2026-114357High· 7.0DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)
CVE-2026-114356High· 7.0DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
CVE-2022-33186Critical· 9.8A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands capable of modifying zoning, disabling …
CVE-2026-78306High· 8.5DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wirele…