Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114356— DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization

Quick assessment

Affected
DJI CrystalSky ZS600C
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在大疆（DJI）CrystalSky ZS600C 设备固件版本 v0.3.9.7 至 v0.6.6.9 中，系统特权 Binder 服务 存在授权缺失漏洞。该漏洞允许 Android 平台上没有任何权限的本地应用程序调用特权操作，包括：执行恢复出厂设置并清除用户数据（事务代码 153）、关机（105）、修改时钟及时区（101/123），以及固件更新交接（151）。其根本原因在于 方法未对调用者身份或权限进行任何检查。

CVSS 7.0 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
DJI CrystalSky ZS600C 0.3.9.7≤ 0.6.6.9 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114356

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
Source: CVE Program / CVE List V5
Vulnerability Description
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/S:P
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
DJI CrystalSky ZS600C 0.3.9.7 ~ 0.6.6.9 -

II. Public POCs for CVE-2026-114356

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114356

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-114356 (1)

Same Patch Batch · DJI · 2026-10-23 · 5 CVEs total

CVE-2026-114357 9.3 CRITICAL DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)
CVE-2026-114354 8.6 HIGH DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
CVE-2026-114355 8.6 HIGH DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root
CVE-2026-114353 7.0 HIGH DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution

IV. Related Vulnerabilities

Same product: CrystalSky ZS600C
Same vendor: DJI
Same weakness: CWE-862

V. Comments for CVE-2026-114356

No comments yet

Leave a comment