CVE-2026-114357High· 7.0▾ TwilightMissing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privile…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).
crystalsky_zs600c >= 0.3.9.7 <= 0.6.6.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114354High· 8.6DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
CVE-2026-114353High· 7.0DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution
CVE-2026-114355High· 8.6DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root
CVE-2026-114356High· 7.0DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
CVE-2026-78306High· 8.5DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wirele…
CVE-2026-77812Critical· 9.4DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption