Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-114357

DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)

Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Dji
Products
Crystalsky Zs600c
CVE-2026-114356

DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Dji
Products
Crystalsky Zs600c
CVE-2026-114355

DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root

OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.

CVSS 4.0 · 8.6 High EPSS 1.2% KEV · Not listed
Vendors
Dji
Products
Crystalsky Zs600c
CVE-2026-114354

DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root

Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Dji
Products
Crystalsky Zs600c
CVE-2026-114353

DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution

Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Dji
Products
Crystalsky Zs600c