Read the docs
TI-2026-79882 Aliases CVE-2026-114353GHSA-pvg3-27hx-g76q

Hidden backdoor in DJI CrystalSky ZS600C gives root command execution

Priority LOW 32CWE-912Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

DJI CrystalSky ZS600C firmware from 0.3.9.7 through 0.6.6.9 on Android contains an undocumented backdoor in its root-privileged assistant daemon (CWE-912). A physically present attacker with USB access can unlock it through the USB-gadget serial interface and run arbitrary operating system commands as root.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00155 4th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DJICrystalSky ZS600C0.3.9.7 – 0.6.6.9—No fix listedCNA
  • CrystalSky ZS600C VendorDJI Affected 0.3.9.7 – 0.6.6.9 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for DJI CrystalSky ZS600C.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-114353
  2. 2026-10-23 Alias added: GHSA-pvg3-27hx-g76q
  3. 2026-10-24 Priority changed: MEDIUM → LOW
  4. 2026-10-28 CISA SSVC decision points changed

References

Advisory 1

  • TI-2007-01042 Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted… CVSS 2.0HIGH 9.3
  • TI-2026-54424 DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory CVSS 4.0CRITICAL 9.3
  • TI-2026-54428 DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media CVSS 4.0HIGH 8.7
  • TI-2026-79886 Missing authentication in DJI CrystalSky ZS600C ADB daemon CVSS 4.0CRITICAL 9.3
  • TI-2026-79884 OS command injection in DJI CrystalSky ZS600C hardware_monitor CVSS 4.0HIGH 8.6
  • TI-2026-54192 Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE CVSS 4.0CRITICAL 9.4
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences