---
id: "CVE-2026-114354"
kind: "vulnerability"
aliases: ["CVE-2026-114354"]
title: "DJI CrystalSky Android: unprivileged app gains root command execution"
severity: "high"
cvss: 8.6
epss: 0.00173
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "CrystalSky ZS600C firmware", "fixed": [], "affected": ">= 0.3.9.7, <= 0.6.6.9", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["android", "crystalsky", "dji", "eol", "firmware", "infrastructure", "local-privilege-escalation"]
not_affected_if: ["no-local-app-install", "no-untrusted-apps-installed", "not-crystalsky-zs600c", "other-dji-devices"]
published_at: "2026-10-23T14:17:35+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114354", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:36:37+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114354", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# DJI CrystalSky Android: unprivileged app gains root command execution

DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 (the last release) has a root-privileged 'assistant' daemon. It registers the binder service android.dji.server, and transaction 1018 passes a caller-supplied string to system() with no permission check. Any installed app with zero permissions gets root command execution; the finders verified this with a permissionless APK. DJI has published no fix, and the device is end-of-life.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CrystalSky ZS600C firmware affected >= 0.3.9.7, <= 0.6.6.9 fixed ?

## How to check

On the controller, open Settings > About and read the firmware version. Any version from 0.3.9.7 to 0.6.6.9 is affected, which in practice means every CrystalSky ZS600C. Over adb, 'adb shell service list' showing android.dji.server also indicates the vulnerable daemon.

## Fix

No fixed version exists, because the device is EOL and 0.6.6.9 is the last release. Mitigate by installing no untrusted apps or sideloaded APKs, disabling USB debugging and ADB, keeping the device off shared networks, and retiring or replacing the device for sensitive work. Check dji.com/downloads/products/crystalsky for any later firmware.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114354
- 2026-10-23T23:36:37+00:00 analyst — Primary source is the finder's advisory (Cyber-Defence Campus, CNA NCSC.ch). No DJI advisory or fix exists: ZS600C is EOL and v0.6.6.9 was the last release. No X chatter, no public PoC link, no exploitation reported. Siblings from the same research: CVE-2026-114353, -114355, -114356, -114357 (unauthenticated ADB, which makes physical or USB access enough).
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114354

## Documents

- [advisory] Binder transaction allows root command execution (Cyber-Defence Campus) https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114354
- [describes] CVE Record CVE-2026-114354 (NCSC.ch CNA) https://www.cve.org/CVERecord?id=CVE-2026-114354

## From the sources

Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_