EUVD-2026-108985

OS command injection in the root-privileged 'hardwaremonitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log logcat, which the helper reads and...