Live › vulnerability › CVE-2026-114356
Go to dashboardThe DJI CrystalSky ZS600C Android firmware exposes a system-privileged binder service, DJIUpdateService, that does not check who is calling it. Any app installed on the device with no permissions can trigger a factory reset, shutdown, clock change, or firmware apply.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only owners of DJI CrystalSky ZS600C devices running firmware from v0.3.9.7 through are exposed. The attacker needs a local app on the device, since the flaw is reached through the Android binder interface. Devices kept off untrusted app installs and on a fixed firmware are not meaningfully exposed.
v0.6.6.9No product ranges from the sources yet.
v0.3.9.7 through v0.6.6.9.v0.6.6.9, per DJI's release notes.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.
This page as .md · .json · in your agent: get_signal("CVE-2026-114356")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.