CVE-2026-114354 in CrystalSky ZS600C
Summary
by MITRE • 10/23/2026
Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in DJI CrystalSky ZS600C firmware versions ranging from v0.3.9.7 through v0.6.6.9 represents a critical failure in access control mechanisms within the Android operating system environment. Specifically, the flaw resides in the native binder service android.dji.server, which is responsible for handling inter-process communication requests on the device. The core technical deficiency involves transaction code 1018, where the service handler accepts input from calling applications without performing any verification of the caller's identity or checking for required permissions. This lack of authorization check allows any local application running on the device to interact with this specific endpoint regardless of its security privileges.
The operational impact of this vulnerability is severe due to the architecture of the underlying daemon processes. The handler associated with transaction code 1018 takes a string provided by the caller and directly passes it as an argument to the system() function within the root-privileged assistant daemon. Because the assistant daemon operates with root-level privileges, any command executed through this vector inherits those elevated permissions. Consequently, a malicious or compromised local application can execute arbitrary operating system commands with full administrative rights on the device. This effectively bypasses all Android sandboxing and permission models that are designed to isolate applications from one another and restrict access to sensitive system resources.
From a classification perspective, this vulnerability aligns closely with CWE-269, which denotes Improper Privilege Management, as it involves an actor obtaining privileges they should not have due to flawed authorization logic. Furthermore, the exploitation technique maps directly to ATT&CK T1055.004, specifically Process Injection via Local Command Execution, and more broadly to T1053.002 for Scheduled Task or Job abuse if persistence is established through command execution. The use of system() without sanitization also highlights CWE-78, Improper Neutralization of Special Elements used in an OS Command, although the primary failure here is the lack of access control rather than input validation alone.
The presence of such a flaw poses significant risks to both device integrity and user privacy. An attacker with local application execution capability can exfiltrate sensitive data stored on the device, modify system configurations, install additional malware, or use the compromised drone controller as a pivot point for further network attacks. Given that these devices are often used in professional environments involving critical infrastructure monitoring or surveillance, the compromise of such hardware could lead to broader security incidents beyond the immediate device scope.
Mitigation strategies must focus on both technical remediation and operational procedures. The primary fix requires implementing strict access control checks within the android.dji.server binder service handler for transaction code 1018. Developers should verify that callers possess specific, high-level permissions before allowing any interaction with the root-privileged assistant daemon. Input validation is also necessary to prevent command injection if arbitrary strings are processed by system() calls, although permission enforcement remains the critical control point. For users unable to update firmware immediately, restricting which applications have local execution capabilities on the device can reduce exposure, though this may impact usability. Firmware updates should be applied promptly once patches become available from DJI to address these authorization gaps and restore proper security boundaries within the Android environment.