{"id":"CVE-2026-114355","kind":"vulnerability","aliases":["CVE-2026-114355"],"related":[],"title":"DJI CrystalSky firmware: local app can run commands as root via logs","description":"OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.","summary":"The root-privileged hardware_monitor helper on DJI CrystalSky ZS600C tablets reads crafted lines from Android logcat and passes them to a shell eval. A local unprivileged process that writes such a line can execute arbitrary commands as root.","severity":"high","cvss":8.6,"epss":0.00953,"exploited":false,"exploited_at":null,"products":[{"name":"CrystalSky ZS600C firmware","fixed":[],"affected":">= 0.3.9.7, <= 0.6.6.9","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","crystalsky","dji","drone-operators","infrastructure","local-privilege-escalation"],"not_affected_if":["no-local-untrusted-apps","other-firmware-versions"],"how_to_check":"Check firmware version in the CrystalSky ZS600C settings (About). Versions 0.3.9.7 to 0.6.6.9 are affected. No DJI-published check method found.","fix":"No fixed firmware published as of 2026-10-23 (unknown; DJI advisory not found). Mitigation: install no untrusted apps on the tablet, and use it only for flight apps.","status":"open","published_at":"2026-10-23T14:17:36+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-23T22:39:12+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:39:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"DJI CrystalSky firmware: local app can run commands as root via logs","impact":"high","summary":"The root-privileged hardware_monitor helper on DJI CrystalSky ZS600C tablets reads crafted lines from Android logcat and passes them to a shell eval. A local unprivileged process that writes such a line can execute arbitrary commands as root.","category":"infrastructure","who_cares":["dji","crystalsky","android","drone-operators"],"confidence":0.6,"needs_auth":"no","worst_case":"Local process gains root code execution on the tablet","analyst_note":"Confirm the fixed firmware version (sources say affected range v0.3.9.7 through v0.6.6.9) and whether DJI has published an advisory with a check method.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-firmware-versions","no-local-untrusted-apps"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000475,"input_tokens":2944,"output_tokens":361,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed firmware version (sources say affected range v0.3.9.7 through v0.6.6.9) and whether DJI has published an advisory with a check method.","search":"'-114355':15A,18A '-2026':14A,17A 'allow':94C 'android':22B,49B,93C,112C 'app':5A 'arbitrari':69B,101C 'command':8A,70B,74C,102C 'craft':46B,108C 'crystalski':2A,23B,42B,86C 'crystalsky':19A 'cve':13A,16A 'dji':1A,24B,41B,85C 'drone':26B 'drone-oper':25B 'escal':32B 'eval':57B,124C 'execut':68B,100C 'firmwar':3A,88C 'firmware':21A 'hardwar':37B,81C 'helper':39B,83C,117C 'infrastructur':28B 'inject':75C 'line':47B,66B,109C 'local':4A,30B,59B,96C 'local-privilege-escal':29B 'log':12A,113C 'logcat':50B,114C 'monitor':38B,82C 'oper':27B 'os':73C 'pass':52B,120C 'privileg':31B,36B,80C 'process':61B,98C 'read':45B,118C 'root':10A,35B,72B,79C,104C 'root-privileg':34B,78C 'run':7A 'shell':56B,123C 'tablet':44B 'unprivileg':60B,97C 'v0.3.9.7':89C 'v0.6.6.9':91C 'via':11A 'write':63B,106C 'zs600c':20A,43B,87C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vulnerability@ncsc.ch","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114355","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114355","severity":null,"published_at":"2026-10-23T14:17:36+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114355:476","url":null,"severity":null,"published_at":"2026-10-23T23:35:31+00:00","modified_at":"2026-10-23T23:35:31+00:00","first_seen_at":"2026-10-23T23:35:31+00:00","fetched_at":"2026-10-23T23:35:31+00:00","note":"CVE record (NCSC.ch CNA, finder Cyber-Defence Campus, Llorenç Romá Alvarez) confirms affected 0.3.9.7 through 0.6.6.9. No fixed firmware or DJI advisory found; the researcher's write-up page returned 404 and the index shows no detail. No PoC or exploitation seen. Sibling CVEs 114353/114354/114356/114357 on the same device."},{"source":"epss","external_id":"CVE-2026-114355","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114355","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":2063,"url":"https://www.cve.org/CVERecord?id=CVE-2026-114355","title":"CVE Record CVE-2026-114355 (NCSC.ch CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2062,"url":"https://cyber-defence-campus.github.io/projects/vulnerabilities/","title":"Cyber-Defence Campus vulnerabilities index (finder)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}