{"id":"CVE-2026-114357","kind":"vulnerability","aliases":["CVE-2026-114357"],"related":[],"title":"DJI CrystalSky ZS600C: adbd lets anyone get an unauthenticated shell","description":"Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).","summary":"The DJI CrystalSky ZS600C firmware from v0.3.9.7 through v0.6.6.9 runs the Android Debug Bridge daemon without requiring authentication, so anyone who can reach the USB port, or the TCP port once ADB over TCP is enabled, gets a shell as uid 2000. That shell is a foothold for escalating to root on the device.","severity":"critical","cvss":9.3,"epss":0.00543,"exploited":false,"exploited_at":null,"products":[{"name":"CrystalSky ZS600C firmware","fixed":[],"affected":">= 0.3.9.7, <= 0.6.6.9","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adb","android-firmware","crystalsky-zs600c","dji","eol","fleet-operators","infrastructure","physical-access"],"not_affected_if":["adb-disabled","firmware-outside-affected-range"],"how_to_check":"Check firmware version (Settings > About) against 0.3.9.7 to 0.6.6.9. On the device: 'getprop ro.adb.secure' (0 = no host auth, vulnerable over USB by default); 'getprop persist.adb.tcp.port' (5555 = network-exposed; ADB over TCP is NOT on by default). From the network: 'nmap -p 5555 <device-ip>'.","fix":"No patched firmware: 0.6.6.9 is the last release and the device is EOL/unsupported. Mitigate: keep ADB over TCP off ('setprop persist.adb.tcp.port -1', do not run /system/bin/adbd_tcp.sh), keep the device off untrusted networks, restrict physical USB access, plan replacement.","status":"open","published_at":"2026-10-23T14:17:49+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-23T22:31:05+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:31:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown: the sources do not name a fixed firmware version. Move off the affected range and disable USB and TCP ADB until a fixed build is confirmed.","reach":"network","title":"DJI CrystalSky ZS600C: adbd lets anyone get an unauthenticated shell","impact":"high","summary":"The DJI CrystalSky ZS600C firmware from v0.3.9.7 through v0.6.6.9 runs the Android Debug Bridge daemon without requiring authentication, so anyone who can reach the USB port, or the TCP port once ADB over TCP is enabled, gets a shell as uid 2000. That shell is a foothold for escalating to root on the device.","category":"infrastructure","who_cares":["dji","crystalsky-zs600c","android-firmware","fleet-operators"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker gets an unauthenticated shell on the device, then can escalate to root.","analyst_note":"Confirm the fixed firmware version and whether ADB over TCP is on by default in shipped builds, using the NVD entry and DJI's advisory.","how_to_check":"Check the firmware version on the device against the affected range v0.3.9.7 to v0.6.6.9.\nOn the device, run 'getprop ro.adb.secure' (0 means no host key check) and 'getprop persist.adb.tcp.port' (5555 means ADB over TCP is on).\nunknown for any other check.","needs_analyst":true,"not_affected_if":["firmware-outside-affected-range","adb-disabled"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000603,"input_tokens":3148,"output_tokens":577,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed firmware version and whether ADB over TCP is on by default in shipped builds, using the NVD entry and DJI's advisory.","search":"'-114357':13A,16A '-2026':12A,15A '/system/bin/adbd_tcp.sh':159C '0':133C '2000':77B,120C '4.0':174C '5555':163C '9.3':176C 'access':35B 'adb':20B,67B,140C,144C 'adbd':4A,102C 'allow':111C 'android':22B,47B,98C 'android-firmwar':21B 'anyon':6A,55B 'attack':113C 'authent':53B,91C 'author':137C 'base':175C 'bridg':49B,100C 'critic':94C 'crystalski':2A,25B,38B,105C 'crystalsky':17A 'crystalsky-zs600c':24B 'cve':11A,14A 'cvss':173C 'daemon':50B,101C 'debug':48B,99C 'default':143C,151C 'devic':89B,129C 'dji':1A,27B,37B,104C 'e.g':155C 'enabl':71B,141C,149C,154C 'eol':28B 'escal':84B,125C 'firmwar':23B,40B,107C 'firmware':19A 'fleet':30B 'fleet-oper':29B 'foothold':82B,122C 'function':95C 'get':7A,72B 'host':135C 'infrastructur':32B 'key':136C 'let':5A 'miss':90C 'network':172C 'obtain':115C 'oper':31B 'persist.adb.tcp.port':162C 'physic':34B 'physical-access':33B 'port':61B,65B 'privileg':124C 'reach':58B 'reachabl':169C 'requir':52B 'ro.adb.secure':132C 'root':86B,127C 'run':45B 'setprop':161C 'shell':10A,74B,79B,118C,167C 'ship':130C,158C 'tcp':64B,69B,146C 'uid':76B,119C 'unauthent':9A,117C,166C 'usb':60B,139C 'v0.3.9.7':42B,108C 'v0.6.6.9':44B,110C 'via':156C 'without':51B 'zs600c':3A,18A,26B,39B,106C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vulnerability@ncsc.ch","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114357","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114357","severity":null,"published_at":"2026-10-23T14:17:49+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114357:175","url":null,"severity":null,"published_at":"2026-10-23T22:11:30+00:00","modified_at":"2026-10-23T22:11:30+00:00","first_seen_at":"2026-10-23T22:11:30+00:00","fetched_at":"2026-10-23T22:11:30+00:00","note":"Read CVE record (NCSC.ch) and finder page (Cyber-Defence Campus). No DJI advisory or patch found; device EOL, 0.6.6.9 is last release. Answer to triage: USB ADB default-on is NOT remotely reachable; network access needs ADB-over-TCP enabled (non-default). Default CVSS is 7.0 physical; the 9.3 critical is the TCP-enabled scenario. No exploitation or PoC found; no social search done (obscure EOL product)."},{"source":"analyst","external_id":"CVE-2026-114357:247","url":null,"severity":null,"published_at":"2026-10-23T22:32:41+00:00","modified_at":"2026-10-23T22:32:41+00:00","first_seen_at":"2026-10-23T22:32:41+00:00","fetched_at":"2026-10-23T22:32:41+00:00","note":"No new sources since run 175. Triage question answered: no fixed firmware exists (0.6.6.9 last release, EOL, no DJI advisory found); ADB over TCP is off by default, USB ADB on by default. Restoring fix and how-to-check that the re-triage cleared."},{"source":"epss","external_id":"CVE-2026-114357","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114357","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":1321,"url":"https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114357","title":"Default-enabled unauthenticated ADB over USB (Cyber-Defence Campus)","kind":"advisory","source":"analyst","text":"Device ships ro.adb.secure=0, USB ADB on by default; ADB-over-TCP reachable once enabled via /system/bin/adbd_tcp.sh or setprop persist.adb.tcp.port 5555. Affected v0.3.9.7 through v0.6.6.9 (last release; device EOL/unsupported). Severity High 7.0.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1322,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-114357","title":"CVE record (NCSC.ch CNA)","kind":"other","source":"analyst","text":"CNA NCSC.ch. CWE-306. Two CVSS4 scenarios: default (physical, USB) 7.0 High; ADB-over-TCP enabled (non-default, network) 9.3 Critical. Affected 0.3.9.7 to 0.6.6.9. Only reference is the Cyber-Defence Campus page; no DJI advisory.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}