Read the docs
TI-2026-79885 Aliases CVE-2026-114356GHSA-pgwp-m7vv-2xhr

Missing authorization in DJI CrystalSky ZS600C update service binder

Priority LOW 30CWE-862Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

DJI CrystalSky ZS600C firmware from v0.3.9.7 through v0.6.6.9 on Android is affected. The system-privileged DJIUpdateService binder performs no caller identity or permission check in onTransact(), so a local application with no permissions can invoke privileged operations. An attacker can trigger a factory reset that wipes user data, shut the device down, change the clock or timezone, or start the firmware-apply hand-off.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00119 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DJICrystalSky ZS600C0.3.9.7 – 0.6.6.9—No fix listedCNA
  • CrystalSky ZS600C VendorDJI Affected 0.3.9.7 – 0.6.6.9 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for DJI CrystalSky ZS600C.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-114356
  2. 2026-10-23 Alias added: GHSA-pgwp-m7vv-2xhr
  3. 2026-10-24 Priority changed: MEDIUM → LOW
  4. 2026-10-28 CISA SSVC decision points changed

References

Advisory 1

  • TI-2007-01042 Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted… CVSS 2.0HIGH 9.3
  • TI-2026-54424 DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory CVSS 4.0CRITICAL 9.3
  • TI-2026-54428 DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media CVSS 4.0HIGH 8.7
  • TI-2026-79886 Missing authentication in DJI CrystalSky ZS600C ADB daemon CVSS 4.0CRITICAL 9.3
  • TI-2026-79884 OS command injection in DJI CrystalSky ZS600C hardware_monitor CVSS 4.0HIGH 8.6
  • TI-2026-54192 Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE CVSS 4.0CRITICAL 9.4
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences