{"id":"CVE-2026-114356","kind":"vulnerability","aliases":["CVE-2026-114356"],"related":[],"title":"DJI CrystalSky ZS600C firmware: update service lets local apps wipe device","description":"Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.","summary":"The DJI CrystalSky ZS600C Android firmware exposes a system-privileged binder service, DJIUpdateService, that does not check who is calling it. Any app installed on the device with no permissions can trigger a factory reset, shutdown, clock change, or firmware apply.","severity":"high","cvss":7.0,"epss":0.00158,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","crystalsky","dji","embedded","infrastructure"],"not_affected_if":["no-third-party-apps","patched-firmware"],"how_to_check":"- Check the firmware version on the device under settings; affected range is `v0.3.9.7` through `v0.6.6.9`.\n- Unknown whether any other check is available from the sources.","fix":"- Update the CrystalSky ZS600C firmware to a version later than `v0.6.6.9`, per DJI's release notes.\n- Uninstall or restrict unknown third-party apps on the device until patched.","status":"open","published_at":"2026-10-23T14:17:36+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:36:54+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:36:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update the CrystalSky ZS600C firmware to a version later than `v0.6.6.9`, per DJI's release notes.\n- Uninstall or restrict unknown third-party apps on the device until patched.","reach":"local","title":"DJI CrystalSky ZS600C firmware: update service lets local apps wipe device","impact":"high","summary":"The DJI CrystalSky ZS600C Android firmware exposes a system-privileged binder service, DJIUpdateService, that does not check who is calling it. Any app installed on the device with no permissions can trigger a factory reset, shutdown, clock change, or firmware apply.","category":"infrastructure","nicknames":[],"who_cares":["dji","crystalsky","android","embedded"],"confidence":0.6,"needs_auth":"no","worst_case":"Local app can factory reset device, wiping user data.","analyst_note":"Confirm the fixed firmware version and vendor advisory from DJI; the NVD entry alone does not name a patched release.","how_to_check":"- Check the firmware version on the device under settings; affected range is `v0.3.9.7` through `v0.6.6.9`.\n- Unknown whether any other check is available from the sources.","needs_analyst":true,"not_affected_if":["patched-firmware","no-third-party-apps"],"who_is_affected":"Only owners of DJI CrystalSky ZS600C devices running firmware from `v0.3.9.7` through `v0.6.6.9` are exposed. The attacker needs a local app on the device, since the flaw is reached through the Android binder interface. Devices kept off untrusted app installs and on a fixed firmware are not meaningfully exposed.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000645,"input_tokens":3390,"output_tokens":611,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114356':14A,17A '-2026':13A,16A '101/123':109C '105':106C '151':118C '153':104C 'allow':84C 'android':18B,27B,83C 'app':9A,46B 'appli':64B,114C 'applic':87C 'author':66C 'binder':34B,73C 'call':43B 'caller':124C 'caller-ident':123C 'chang':61B,108C 'check':40B,128C 'clock':60B 'clock/timezone':107C 'crystalski':2A,19B,25B,76C 'cve':12A,15A 'data':101C 'devic':11A,50B 'dji':1A,20B,24B,75C 'djiupdateservic':36B,72C 'embed':21B 'expos':29B 'factori':57B,96C 'firmwar':4A,28B,63B,78C,113C 'firmware-appli':112C 'hand':116C 'hand-off':115C 'ident':125C 'includ':95C 'infrastructur':22B 'instal':47B 'invok':92C 'let':7A 'local':8A,86C 'miss':65C 'ontransact':120C 'oper':94C 'perform':121C 'permiss':53B,90C,127C 'privileg':33B,71C,93C 'reset':58B,97C 'servic':6A,35B 'shutdown':59B,105C 'system':32B,70C 'system-privileg':31B,69C 'transact':103C 'trigger':55B 'updat':5A 'user':100C 'user-data':99C 'v0.3.9.7':79C 'v0.6.6.9':81C 'wipe':10A,102C 'zs600c':3A,26B,77C","nicknames":[],"mitigations":[],"who_affected":"Only owners of DJI CrystalSky ZS600C devices running firmware from `v0.3.9.7` through `v0.6.6.9` are exposed. The attacker needs a local app on the device, since the flaw is reached through the Android binder interface. Devices kept off untrusted app installs and on a fixed firmware are not meaningfully exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vulnerability@ncsc.ch","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114356","severity":null,"published_at":"2026-10-23T14:17:36+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114356","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114356","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}