CVE-2026-114356

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe transaction 153, shutdown 105...

CVE-2026-114356 DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe transaction 153, shutdown 105...

CVE-2026-114356

The DJI CrystalSky ZS600C device, running firmware versions v0.3.9.7 through v0.6.6.9 on Android, contains a missing authorization vulnerability in the system-privileged DJIUpdateService binder. Because the onTransact() function fails to perform caller-identity or permission checks, a local appli...

EUVD-2026-108988

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe transaction 153, shutdown 105...

PT-2026-122098

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe transaction 153, shutdown 105...