---
id: "CVE-2026-114357"
kind: "vulnerability"
aliases: ["CVE-2026-114357"]
title: "DJI CrystalSky ZS600C: adbd lets anyone get an unauthenticated shell"
severity: "critical"
cvss: 9.3
epss: 0.00543
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "CrystalSky ZS600C firmware", "fixed": [], "affected": ">= 0.3.9.7, <= 0.6.6.9", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adb", "android-firmware", "crystalsky-zs600c", "dji", "eol", "fleet-operators", "infrastructure", "physical-access"]
not_affected_if: ["adb-disabled", "firmware-outside-affected-range"]
published_at: "2026-10-23T14:17:49+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114357", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:11:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:32:41+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114357", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# DJI CrystalSky ZS600C: adbd lets anyone get an unauthenticated shell

The DJI CrystalSky ZS600C firmware from v0.3.9.7 through v0.6.6.9 runs the Android Debug Bridge daemon without requiring authentication, so anyone who can reach the USB port, or the TCP port once ADB over TCP is enabled, gets a shell as uid 2000. That shell is a foothold for escalating to root on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CrystalSky ZS600C firmware affected >= 0.3.9.7, <= 0.6.6.9 fixed ?

## How to check

Check firmware version (Settings > About) against 0.3.9.7 to 0.6.6.9. On the device: 'getprop ro.adb.secure' (0 = no host auth, vulnerable over USB by default); 'getprop persist.adb.tcp.port' (5555 = network-exposed; ADB over TCP is NOT on by default). From the network: 'nmap -p 5555 <device-ip>'.

## Fix

No patched firmware: 0.6.6.9 is the last release and the device is EOL/unsupported. Mitigate: keep ADB over TCP off ('setprop persist.adb.tcp.port -1', do not run /system/bin/adbd_tcp.sh), keep the device off untrusted networks, restrict physical USB access, plan replacement.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114357
- 2026-10-23T22:11:30+00:00 analyst — Read CVE record (NCSC.ch) and finder page (Cyber-Defence Campus). No DJI advisory or patch found; device EOL, 0.6.6.9 is last release. Answer to triage: USB ADB default-on is NOT remotely reachable; network access needs ADB-over-TCP enabled (non-default). Default CVSS is 7.0 physical; the 9.3 critical is the TCP-enabled scenario. No exploitation or PoC found; no social search done (obscure EOL product).
- 2026-10-23T22:32:41+00:00 analyst — No new sources since run 175. Triage question answered: no fixed firmware exists (0.6.6.9 last release, EOL, no DJI advisory found); ADB over TCP is off by default, USB ADB on by default. Restoring fix and how-to-check that the re-triage cleared.
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114357

## Documents

- [advisory] Default-enabled unauthenticated ADB over USB (Cyber-Defence Campus) https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114357
- [describes] CVE record (NCSC.ch CNA) https://cveawg.mitre.org/api/cve/CVE-2026-114357

## From the sources

Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_