Read the docs
TI-2026-79884 Aliases CVE-2026-114355GHSA-258v-3gxg-h7w6

OS command injection in DJI CrystalSky ZS600C hardware_monitor

Priority MEDIUM 42CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

DJI CrystalSky ZS600C firmware from 0.3.9.7 through 0.6.6.9 on Android is affected. The root-privileged hardware_monitor helper passes data read from the Android log to a shell eval without neutralizing special characters, which is an OS command injection flaw (CWE-78). A local unprivileged process that writes a crafted line to the Android log can execute arbitrary commands as root.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01206 68th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DJICrystalSky ZS600C0.3.9.7 – 0.6.6.9—No fix listedCNA
  • CrystalSky ZS600C VendorDJI Affected 0.3.9.7 – 0.6.6.9 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for DJI CrystalSky ZS600C.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-114355
  2. 2026-10-23 Alias added: GHSA-258v-3gxg-h7w6
  3. 2026-10-24 Priority changed: MEDIUM → LOW
  4. 2026-10-25 Priority changed: LOW → MEDIUM
  5. 2026-10-28 CISA SSVC decision points changed

References

Advisory 1

  • TI-2007-01042 Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted… CVSS 2.0HIGH 9.3
  • TI-2026-54424 DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory CVSS 4.0CRITICAL 9.3
  • TI-2026-54428 DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media CVSS 4.0HIGH 8.7
  • TI-2026-79886 Missing authentication in DJI CrystalSky ZS600C ADB daemon CVSS 4.0CRITICAL 9.3
  • TI-2026-54192 Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE CVSS 4.0CRITICAL 9.4
  • TI-2022-22944 DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections… CVSS 3.1CRITICAL 9.1
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences