{"id":"CVE-2026-114353","kind":"vulnerability","aliases":["CVE-2026-114353"],"related":[],"title":"DJI CrystalSky: hidden USB command lets a local attacker run root commands","description":"Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().","summary":"The root-privileged 'assistant' daemon on DJI CrystalSky ZS600C tablets contains an undocumented backdoor. A person with physical USB access who sends a hard-coded magic string over the USB serial port gets every following line run as a root shell command.","severity":"high","cvss":7.0,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[{"name":"CrystalSky ZS600C firmware","fixed":[],"affected":">= 0.3.9.7, <= 0.6.6.9","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","crystalsky","dji","drones","embedded","eol","infrastructure","no-fix","physical-access"],"not_affected_if":["firmware-outside-range","no-crystalsky-zs600c","no-physical-access"],"how_to_check":"- Settings > About on the ZS600C: firmware v0.3.9.7 through v0.6.6.9 is affected, and every release is, since v0.6.6.9 is the last.\n- Via adb or a shell, check whether the assistant daemon runs as root (ps -A | grep assistant) and whether /dev/ttyGS0 exists.","fix":"No fix: v0.6.6.9 is the last release and the device is EOL/unsupported (per finder). No DJI advisory found. Mitigate by controlling physical and USB access, or retire the device.","status":"open","published_at":"2026-10-23T14:17:33+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:36:56+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-10-25T03:36:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"DJI CrystalSky: hidden USB command lets a local attacker run root commands","impact":"high","summary":"The root-privileged 'assistant' daemon on DJI CrystalSky ZS600C tablets contains an undocumented backdoor. A person with physical USB access who sends a hard-coded magic string over the USB serial port gets every following line run as a root shell command.","category":"infrastructure","nicknames":[],"who_cares":["dji","crystalsky","android","embedded","drones"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker gains root command execution on the device via USB","analyst_note":"Check the vendor's firmware fix status for v0.6.6.9 and later; the sources give no fixed version or vendor advisory link.","how_to_check":"- Check the firmware version on the CrystalSky ZS600C against the affected range v0.3.9.7 through v0.6.6.9\n- Confirm whether the 'assistant' daemon is present and running with root privileges on the device","needs_analyst":true,"not_affected_if":["no-crystalsky-zs600c","firmware-outside-range"],"who_is_affected":"Owners and fleet managers of DJI CrystalSky ZS600C devices running firmware from v0.3.9.7 through v0.6.6.9. Exposure requires physical access with a USB connection to the device; devices kept under physical control and not connected to untrusted USB hosts carry much less risk. Teams with no CrystalSky ZS600C units can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000623,"input_tokens":3387,"output_tokens":569,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the vendor's firmware fix status for v0.6.6.9 and later; the sources give no fixed version or vendor advisory link.","search":"'-114353':15A,18A '-2026':14A,17A '/dev/ttygs0':132C 'access':34B,55B,108C 'allow':100C 'android':22B,99C 'arbitrari':111C 'assist':39B,88C 'attack':9A,105C 'backdoor':49B,82C 'code':61B,121C 'command':5A,12A,78B,113C 'contain':46B 'crystalski':2A,23B,43B,92C 'crystalsky':19A 'cve':13A,16A 'daemon':40B,89C 'dji':1A,24B,42B,91C 'dji26656677':124C 'drone':25B 'embed':26B 'eol':27B 'everi':70B 'execut':110C 'firmwar':94C 'firmware':21A 'fix':31B 'follow':71B 'function':80C 'gadget':129C 'get':69B 'hard':60B,120C 'hard-cod':59B,119C 'hidden':3A,79C 'infrastructur':28B 'interfac':131C 'let':6A 'line':72B,137C 'local':8A 'magic':62B,122C 'no-fix':29B 'os':112C 'pass':139C 'person':51B 'physic':33B,53B,103C 'physical-access':32B 'physically-pres':102C 'port':68B 'present':104C 'privileg':38B,87C 'root':11A,37B,76B,86C,115C 'root-privileg':36B,85C 'run':10A,73B 'send':57B,117C 'serial':67B,130C 'shell':77B 'string':63B,123C 'subsequ':136C 'system':141C 'tablet':45B 'undocu':48B,81C 'usb':4A,54B,66B,107C,128C 'usb-gadget':127C 'v0.3.9.7':95C 'v0.6.6.9':97C 'zs600c':20A,44B,93C","nicknames":[],"mitigations":[],"who_affected":"Owners and fleet managers of DJI CrystalSky ZS600C devices running firmware from v0.3.9.7 through v0.6.6.9. Exposure requires physical access with a USB connection to the device; devices kept under physical control and not connected to untrusted USB hosts carry much less risk. Teams with no CrystalSky ZS600C units can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vulnerability@ncsc.ch","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114353","severity":null,"published_at":"2026-10-23T14:17:33+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114353:757","url":null,"severity":null,"published_at":"2026-10-25T03:37:59+00:00","modified_at":"2026-10-25T03:37:59+00:00","first_seen_at":"2026-10-25T03:37:59+00:00","fetched_at":"2026-10-25T03:37:59+00:00","note":"Finder write-up (Cyber-Defence Campus) read: affected v0.3.9.7-0.6.6.9, which is the last release; device EOL so no vendor fix or DJI advisory found. Not exploited per OffSeq/NVD; no public PoC beyond the magic string."},{"source":"epss","external_id":"CVE-2026-114353","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114353","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":3258,"url":"https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114353/","title":"assistant daemon hard-coded USB backdoor (Cyber-Defence Campus)","kind":"advisory","source":"analyst","text":"Root-privileged assistant daemon listens on /dev/ttyGS0; magic string dji26656677 then each line passed to system() as root. Affected firmware v0.3.9.7 through v0.6.6.9 (last release; device EOL/unsupported). Verified on device (uid=0).","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}