Read the docs
TI-2026-79883 Aliases CVE-2026-114354GHSA-f65q-v44p-qw67

DJI CrystalSky binder service lets local apps run commands as root

Priority LOW 38CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution, Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78 and CWE-862.

Summary

DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android lacks an authorization check in the native binder service android.dji.server (CWE-862). A local application with no permissions can reach a handler that passes a caller-supplied string to system() in the root-privileged assistant daemon, so it can run arbitrary OS commands as root.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0013 2nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DJICrystalSky ZS600C0.3.9.7 – 0.6.6.9—No fix listedCNA
  • CrystalSky ZS600C VendorDJI Affected 0.3.9.7 – 0.6.6.9 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for DJI CrystalSky ZS600C.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-114354
  2. 2026-10-23 Alias added: GHSA-f65q-v44p-qw67
  3. 2026-10-24 Priority changed: MEDIUM → LOW
  4. 2026-10-28 CISA SSVC decision points changed

References

Advisory 1

  • TI-2007-01042 Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted… CVSS 2.0HIGH 9.3
  • TI-2026-54424 DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory CVSS 4.0CRITICAL 9.3
  • TI-2026-54428 DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media CVSS 4.0HIGH 8.7
  • TI-2026-79886 Missing authentication in DJI CrystalSky ZS600C ADB daemon CVSS 4.0CRITICAL 9.3
  • TI-2026-79884 OS command injection in DJI CrystalSky ZS600C hardware_monitor CVSS 4.0HIGH 8.6
  • TI-2026-54192 Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE CVSS 4.0CRITICAL 9.4
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences