Live › vulnerability › CVE-2026-114353
Go to dashboardThe root-privileged 'assistant' daemon on DJI CrystalSky ZS600C tablets contains an undocumented backdoor. A person with physical USB access who sends a hard-coded magic string over the USB serial port gets every following line run as a root shell command.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Owners and fleet managers of DJI CrystalSky ZS600C devices running firmware from v0.3.9.7 through v0.6.6.9. Exposure requires physical access with a USB connection to the device; devices kept under physical control and not connected to untrusted USB hosts carry much less risk. Teams with no CrystalSky ZS600C units can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| CrystalSky ZS600C firmware | vendor | >= 0.3.9.7, <= 0.6.6.9 | – |
v0.6.6.9 is the last release and the device is EOL/unsupported (per finder)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().
This page as .md · .json · in your agent: get_signal("CVE-2026-114353")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.