Live › vulnerability › CVE-2026-114354
Go to dashboardDJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 (the last release) has a root-privileged 'assistant' daemon. It registers the binder service android.dji.server, and transaction 1018 passes a caller-supplied string to system() with no permission check. Any installed app with zero permissions gets root command execution; the finders verified this with a permissionless APK. DJI has published no fix, and the device is end-of-life.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| CrystalSky ZS600C firmware | vendor | >= 0.3.9.7, <= 0.6.6.9 | – |
0.3.9.7 to 0.6.6.9 is affected, which in practice means every CrystalSky ZS600Cadb shell service list showing android.dji.server also indicates the vulnerable daemon0.6.6.9 is the last releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.
This page as .md · .json · in your agent: get_signal("CVE-2026-114354")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.