---
id: "CVE-2026-114356"
kind: "vulnerability"
aliases: ["CVE-2026-114356"]
title: "DJI CrystalSky ZS600C firmware: update service lets local apps wipe device"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["android", "crystalsky", "dji", "embedded", "infrastructure"]
not_affected_if: ["no-third-party-apps", "patched-firmware"]
published_at: "2026-10-23T14:17:36+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T03:36:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114356", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# DJI CrystalSky ZS600C firmware: update service lets local apps wipe device

The DJI CrystalSky ZS600C Android firmware exposes a system-privileged binder service, DJIUpdateService, that does not check who is calling it. Any app installed on the device with no permissions can trigger a factory reset, shutdown, clock change, or firmware apply.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the firmware version on the device under settings; affected range is `v0.3.9.7` through `v0.6.6.9`.
- Unknown whether any other check is available from the sources.

## Fix

- Update the CrystalSky ZS600C firmware to a version later than `v0.6.6.9`, per DJI's release notes.
- Uninstall or restrict unknown third-party apps on the device until patched.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114356

## From the sources

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_