Read the docs
TI-2026-79886 Aliases CVE-2026-114357GHSA-826v-5gj2-v5c8

Missing authentication in DJI CrystalSky ZS600C ADB daemon

Priority MEDIUM 42CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

DJI CrystalSky ZS600C firmware from v0.3.9.7 through v0.6.6.9 has missing authentication for a critical function in the Android Debug Bridge daemon (adbd). The device ships with ro.adb.secure=0, so an attacker can obtain an unauthenticated shell with uid 2000, which is a foothold for privilege escalation to root. ADB over TCP is off by default, but once enabled, the same unauthenticated shell is reachable over the network. CWE-306.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0031 24th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DJICrystalSky ZS600C0.3.9.7 – 0.6.6.9—No fix listedCNA
  • CrystalSky ZS600C VendorDJI Affected 0.3.9.7 – 0.6.6.9 Fixed in — No fix listed CNA

Remediation

No fixed version is listed for DJI CrystalSky ZS600C.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-114357
  2. 2026-10-23 Alias added: GHSA-826v-5gj2-v5c8
  3. 2026-10-28 CISA SSVC decision points changed

References

Advisory 1

  • TI-2007-01042 Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted… CVSS 2.0HIGH 9.3
  • TI-2026-54424 DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory CVSS 4.0CRITICAL 9.3
  • TI-2026-54428 DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media CVSS 4.0HIGH 8.7
  • TI-2026-79884 OS command injection in DJI CrystalSky ZS600C hardware_monitor CVSS 4.0HIGH 8.6
  • TI-2026-54192 Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE CVSS 4.0CRITICAL 9.4
  • TI-2022-22944 DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections… CVSS 3.1CRITICAL 9.1
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences