CVE-2026-114353

Hidden functionality undocumented backdoor in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string...

CVE-2026-114354 DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root

Missing authorization in the native binder service 'android.dji.server' transaction code 1018 in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplie...

CVE-2026-114354

The DJI CrystalSky ZS600C firmware (v0.3.9.7 through v0.6.6.9) on Android is vulnerable to a command injection vulnerability due to missing authorization in the native binder service 'android.dji.server' (transaction code 1018). A local application with no permissions can execute arbitrary OS com...

CVE-2026-114353 DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution

Hidden functionality undocumented backdoor in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string...

CVE-2026-114353

The DJI CrystalSky ZS600C (firmware v0.3.9.7 through v0.6.6.9 ) on Android contains a hidden backdoor within the root-privileged 'assistant' daemon . A physically-present attacker with USB access can execute arbitrary OS commands as root by sending the hard-coded magic string dji26656677 to the U...

EUVD-2026-108980

Hidden functionality undocumented backdoor in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string...

PT-2026-122096

Missing authorization in the native binder service 'android.dji.server' transaction code 1018 in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplie...

PT-2026-122095

Hidden functionality undocumented backdoor in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string...