CVE-2026-114357 DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)

Missing authentication for a critical function in the Android Debug Bridge daemon adbd in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell uid 2000, a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 no...

CVE-2026-114357

The DJI CrystalSky ZS600C (firmware v0.3.9.7 through v0.6.6.9 ) is vulnerable to an unauthenticated shell access due to the Android Debug Bridge daemon (adbd) shipping with ro.adb.secure=0 , meaning it lacks host key authorization. Attackers can obtain a shell with uid 2000 , providing a foothold...