Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114353— DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution

Quick assessment

Affected
DJI CrystalSky ZS600C
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

大疆（DJI）CrystalSky ZS600C 设备中，Android 系统上运行的 root 权限"assistant"守护进程存在隐藏功能（未文档化的后门）。该漏洞影响固件版本 v0.3.9.7 至 v0.6.6.9。具备 USB 物理访问权限的攻击者可通过向 USB 设备模拟串口接口（/dev/ttyGS0）发送硬编码的魔串"dji26656677"，触发该后门，从而以 root 权限执行任意操作系统命令；此后，该接口接收的每一行后续输入均会被直接传递给 system() 函数执行。

CVSS 7.0 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
DJI CrystalSky ZS600C 0.3.9.7≤ 0.6.6.9 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114353

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution
Source: CVE Program / CVE List V5
Vulnerability Description
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P
Source: CVE Program / CVE List V5
Vulnerability Type
隐藏功能
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
DJI CrystalSky ZS600C 0.3.9.7 ~ 0.6.6.9 -

II. Public POCs for CVE-2026-114353

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114353

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-114353 (1)

Same Patch Batch · DJI · 2026-10-23 · 5 CVEs total

CVE-2026-114357 9.3 CRITICAL DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)
CVE-2026-114354 8.6 HIGH DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
CVE-2026-114355 8.6 HIGH DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root
CVE-2026-114356 7.0 HIGH DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without author

IV. Related Vulnerabilities

Same product: CrystalSky ZS600C
Same vendor: DJI
Same weakness: CWE-912

V. Comments for CVE-2026-114353

No comments yet

Leave a comment