CVE-2026-114353

The DJI CrystalSky ZS600C (firmware v0.3.9.7 through v0.6.6.9 ) on Android contains a hidden backdoor within the root-privileged 'assistant' daemon . A physically-present attacker with USB access can execute arbitrary OS commands as root by sending the hard-coded magic string dji26656677 to the U...