Missing Authorization Vulnerability in DJI CrystalSky Firmware by DJI
CVE-2026-114356

7HIGH

Key Information:

Vendor

Dji

Status
Crystalsky Zs600c
Vendor
CVE Published:
23 October 2026

What is CVE-2026-114356?

A security flaw exists in the DJI CrystalSky ZS600C firmware, where the 'DJIUpdateService' binder lacks proper authorization checks. This vulnerability enables local applications, even those without specific permissions, to execute privileged actions. The affected firmware versions, ranging from v0.3.9.7 to v0.6.6.9, allow unauthorized operations such as initiating a factory reset, shutting down the device, altering system time and timezone settings, and improperly applying firmware updates due to the absence of caller-identity or permission validations in the onTransact() method.

Affected Version(s)

CrystalSky ZS600C Android 0.3.9.7 <= 0.6.6.9

References

https://cyber-defence-campus.github.io/projects/vulnerabi...
third-party-advisory

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Llorenç Romá Alvarez, Security Researcher, Cyber Defence Campus, Switzerland
.