Live › vulnerability › CVE-2026-114357
Go to dashboardThe DJI CrystalSky ZS600C firmware from v0.3.9.7 through v0.6.6.9 runs the Android Debug Bridge daemon without requiring authentication, so anyone who can reach the USB port, or the TCP port once ADB over TCP is enabled, gets a shell as uid 2000. That shell is a foothold for escalating to root on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| CrystalSky ZS600C firmware | vendor | >= 0.3.9.7, <= 0.6.6.9 | – |
0.3.9.7 to 0.6.6.9getprop ro.adb.secure (0 = no host auth, vulnerable over USB by default); getprop persist.adb.tcp.port (5555 = network-exposed; ADB over TCP is NOT on by default)nmap -p 5555 <device-ip>0.6.6.9 is the last release and the device is EOL/unsupportedsetprop persist.adb.tcp.port -1, do not run /system/bin/adbd_tcp.sh), keep the device off untrusted networks, restrict physical USB access, plan replacementEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).
This page as .md · .json · in your agent: get_signal("CVE-2026-114357")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.