Undocumented Backdoor in DJI CrystalSky ZS600C Firmware
CVE-2026-114353

7HIGH

Key Information:

Vendor

Dji

Status
Crystalsky Zs600c
Vendor
CVE Published:
23 October 2026

What is CVE-2026-114353?

The DJI CrystalSky ZS600C firmware contains an undocumented backdoor in the 'assistant' daemon, allowing attackers with physical USB access to execute arbitrary operating system commands as root. By sending a specific hard-coded string through the USB-gadget serial interface, a malicious actor can manipulate system-level processes, posing significant security risks for the device.

Affected Version(s)

CrystalSky ZS600C Android 0.3.9.7 <= 0.6.6.9

References

https://cyber-defence-campus.github.io/projects/vulnerabi...
third-party-advisory

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Llorenç Romá Alvarez, Security Researcher, Cyber Defence Campus, Switzerland
.