CVE-2026-114356High· 7.0▾ TwilightMissing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including fac…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.
crystalsky_zs600c >= 0.3.9.7 <= 0.6.6.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114354High· 8.6DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
CVE-2026-114353High· 7.0DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution
CVE-2026-114355High· 8.6DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root
CVE-2026-114357High· 7.0DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)
CVE-2026-78306High· 8.5DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wirele…
CVE-2026-77812Critical· 9.4DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption