OS Command Injection Vulnerability in DJI CrystalSky Firmware
CVE-2026-114355

8.6HIGH

Key Information:

Vendor

Dji

Status
Crystalsky Zs600c
Vendor
CVE Published:
23 October 2026

What is CVE-2026-114355?

The DJI CrystalSky ZS600C firmware contains an OS command injection vulnerability in its 'hardware_monitor' helper. This flaw allows a local unprivileged process to execute arbitrary commands as root by writing crafted entries to the Android log (logcat). The vulnerable firmware versions are from v0.3.9.7 to v0.6.6.9. If exploited, this could lead to unauthorized access and manipulation of the underlying system, presenting significant security risks for users.

Affected Version(s)

CrystalSky ZS600C Android 0.3.9.7 <= 0.6.6.9

References

https://cyber-defence-campus.github.io/projects/vulnerabi...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Llorenç Romá Alvarez, Security Researcher, Cyber Defence Campus, Switzerland
.