Missing Authentication in DJI CrystalSky ZS600C Firmware
CVE-2026-114357

9.3CRITICAL

Key Information:

Vendor

Dji

Status
Crystalsky Zs600c
Vendor
CVE Published:
23 October 2026

What is CVE-2026-114357?

The DJI CrystalSky ZS600C firmware suffers from a missing authentication vulnerability within the Android Debug Bridge daemon (adbd). This flaw permits unauthorized users to obtain an unauthenticated shell with user ID 2000, paving the way for potential privilege escalation to root level. By default, the device is configured to allow USB ADB access without host key authorization and the TCP ADB feature can be enabled, which opens the door for attackers to exploit this vulnerability over the network as well, enhancing the risk of unauthorized access to critical functionalities.

Affected Version(s)

CrystalSky ZS600C Android 0.3.9.7 <= 0.6.6.9

References

https://cyber-defence-campus.github.io/projects/vulnerabi...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Llorenç Romá Alvarez, Security Researcher, Cyber Defence Campus, Switzerland
.