{"id":"CVE-2026-114354","kind":"vulnerability","aliases":["CVE-2026-114354"],"related":[],"title":"DJI CrystalSky Android: unprivileged app gains root command execution","description":"Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.","summary":"DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 (the last release) has a root-privileged 'assistant' daemon. It registers the binder service android.dji.server, and transaction 1018 passes a caller-supplied string to system() with no permission check. Any installed app with zero permissions gets root command execution; the finders verified this with a permissionless APK. DJI has published no fix, and the device is end-of-life.","severity":"high","cvss":8.6,"epss":0.00173,"exploited":false,"exploited_at":null,"products":[{"name":"CrystalSky ZS600C firmware","fixed":[],"affected":">= 0.3.9.7, <= 0.6.6.9","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","crystalsky","dji","eol","firmware","infrastructure","local-privilege-escalation"],"not_affected_if":["no-local-app-install","no-untrusted-apps-installed","not-crystalsky-zs600c","other-dji-devices"],"how_to_check":"On the controller, open Settings > About and read the firmware version. Any version from 0.3.9.7 to 0.6.6.9 is affected, which in practice means every CrystalSky ZS600C. Over adb, 'adb shell service list' showing android.dji.server also indicates the vulnerable daemon.","fix":"No fixed version exists, because the device is EOL and 0.6.6.9 is the last release. Mitigate by installing no untrusted apps or sideloaded APKs, disabling USB debugging and ADB, keeping the device off shared networks, and retiring or replacing the device for sensitive work. Check dji.com/downloads/products/crystalsky for any later firmware.","status":"open","published_at":"2026-10-23T14:17:35+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-23T22:39:13+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:39:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"DJI CrystalSky Android: unprivileged app gains root command execution","impact":"high","summary":"A DJI CrystalSky ZS600C firmware bug lets any local app with no permissions call a native binder service that passes its input to system() as root. An attacker who gets a malicious app onto the device can run arbitrary OS commands as root.","category":"infrastructure","who_cares":["dji","crystalsky","android","firmware"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs arbitrary commands as root on the device.","analyst_note":"Find the DJI vendor advisory or firmware release notes for the fixed version; the NVD entry gives only the affected range v0.3.9.7 to v0.6.6.9.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-dji-devices","no-local-app-install"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000475,"input_tokens":2954,"output_tokens":359,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the DJI vendor advisory or firmware release notes for the fixed version; the NVD entry gives only the affected range v0.3.9.7 to v0.6.6.9.","search":"'-114354':12A,15A '-2026':11A,14A '1018':54B,108C 'allow':119C 'android':3A,19B,118C 'android.dji.server':51B,105C 'apk':84B 'app':5A,69B 'applic':122C 'arbitrari':128C 'assist':44B,149C 'author':99C 'binder':49B,103C 'caller':58B,139C,154C 'caller-ident':153C 'caller-suppli':57B,138C 'check':66B,158C 'code':107C 'command':8A,75B,130C 'crystalski':2A,20B,30B,111C 'crystalsky':16A 'cve':10A,13A 'daemon':45B,150C 'devic':92B 'dji':1A,21B,29B,85B,110C 'end':95B 'end-of-lif':94B 'eol':22B 'escal':28B 'execut':9A,76B,127C 'finder':78B 'firmwar':23B,32B,113C 'firmware':18A 'fix':89B 'gain':6A 'get':73B 'handler':135C 'ident':155C 'infrastructur':24B 'instal':68B 'last':37B 'life':97B 'local':26B,121C 'local-privilege-escal':25B 'miss':98C 'nativ':102C 'os':129C 'pass':55B,136C 'permiss':65B,72B,125C,157C 'permissionless':83B 'privileg':27B,43B,148C 'publish':87B 'regist':47B 'releas':38B 'root':7A,42B,74B,132C,147C 'root-privileg':41B,146C 'servic':50B,104C 'string':60B,141C 'suppli':59B,140C 'system':62B,143C 'transact':53B,106C 'unprivileg':4A 'v0.3.9.7':33B,114C 'v0.6.6.9':35B,116C 'verifi':79B 'without':151C 'zero':71B 'zs600c':17A,31B,112C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vulnerability@ncsc.ch","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114354","severity":null,"published_at":"2026-10-23T14:17:35+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114354:477","url":null,"severity":null,"published_at":"2026-10-23T23:36:37+00:00","modified_at":"2026-10-23T23:36:37+00:00","first_seen_at":"2026-10-23T23:36:37+00:00","fetched_at":"2026-10-23T23:36:37+00:00","note":"Primary source is the finder's advisory (Cyber-Defence Campus, CNA NCSC.ch). No DJI advisory or fix exists: ZS600C is EOL and v0.6.6.9 was the last release. No X chatter, no public PoC link, no exploitation reported. Siblings from the same research: CVE-2026-114353, -114355, -114356, -114357 (unauthenticated ADB, which makes physical or USB access enough)."},{"source":"epss","external_id":"CVE-2026-114354","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114354","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":2071,"url":"https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114354","title":"Binder transaction allows root command execution (Cyber-Defence Campus)","kind":"advisory","source":"analyst","text":"Native binder service android.dji.server, registered by root assistant daemon, exposes transaction 1018 which passes a caller-supplied string to system() with no caller check. Any app with zero permissions can run commands as root. Affected firmware v0.3.9.7 through v0.6.6.9 (last release; device is EOL/unsupported). Verified from a permissionless APK (uid=0).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2072,"url":"https://www.cve.org/CVERecord?id=CVE-2026-114354","title":"CVE Record CVE-2026-114354 (NCSC.ch CNA)","kind":"other","source":"analyst","text":"CVSS 4.0 8.6 AV:L/PR:N. CWE-78, CWE-862. Affected 0.3.9.7 through 0.6.6.9. Credit: Llorenç Romá Alvarez, Cyber Defence Campus.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}