Authorization Bypass in DJI CrystalSky ZS600C Firmware
CVE-2026-114354

8.6HIGH

Key Information:

Vendor

Dji

Status
Crystalsky Zs600c
Vendor
CVE Published:
23 October 2026

What is CVE-2026-114354?

The DJI CrystalSky ZS600C firmware contains a significant vulnerability where missing authorization in the native binder service enables unauthorized local applications to execute arbitrary OS commands as root. This risk arises from the handler's transmission of caller-supplied strings to the system() function in the root-privileged 'assistant' daemon, severely compromising system integrity and security. Users of affected versions should apply the necessary updates or mitigation strategies promptly to safeguard their devices.

Affected Version(s)

CrystalSky ZS600C Android 0.3.9.7 <= 0.6.6.9

References

https://cyber-defence-campus.github.io/projects/vulnerabi...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Llorenç Romá Alvarez, Security Researcher, Cyber Defence Campus, Switzerland
.