CVE-2026-114356 in CrystalSky ZS600C
Summary
by MITRE • 10/23/2026
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in DJI CrystalSky ZS600C firmware versions v0.3.9.7 through v0.6.6.9 represents a critical failure in access control mechanisms within the Android operating system environment. Specifically, the flaw resides in the 'DJIUpdateService' binder service, which operates with elevated system privileges. In Android architecture, binders serve as the inter-process communication mechanism that allows applications to invoke methods on services running in other processes or at different privilege levels. The core technical deficiency is a complete absence of authorization checks within the onTransact() method of this specific binder implementation. Normally, when an application attempts to communicate with a privileged service via IPC, the system should verify whether the calling process possesses the necessary permissions defined by Android's security model. However, in this instance, the service accepts requests from any local application regardless of its permission profile or identity, effectively bypassing the operating system's intended isolation boundaries.
This lack of caller-identity verification and permission checking allows a malicious or compromised local application with no special privileges to execute high-risk operations as if it were running under the system account. The impact is severe because the exposed transactions include factory reset functionality that wipes user data, which corresponds to CWE-284 Improper Access Control. By invoking transaction 153, an attacker can trigger a complete wipe of the device's storage, leading to permanent loss of critical configuration and personal data without any authentication or consent from the legitimate owner. This aligns with the ATT&CK technique T1490 Inhibit System Recovery, as it prevents the user from maintaining their operational state by destroying local recovery options and stored information.
Beyond data destruction, the vulnerability enables unauthorized modification of system time and timezone settings through transactions 101 and 123. Manipulating these parameters can disrupt logging mechanisms, invalidate security certificates that rely on accurate timestamps, and interfere with scheduled tasks or synchronization processes essential for device stability. Furthermore, transaction 151 allows an unprivileged application to initiate the firmware-apply hand-off process. This capability is particularly dangerous as it could potentially be leveraged in conjunction with other vulnerabilities to force a malicious firmware update or disrupt the normal boot sequence, leading to service denial. The ability to trigger a system shutdown via transaction 105 further exacerbates the risk by allowing an attacker to abruptly terminate all running processes and services, causing immediate availability issues for connected drones or ground control stations that rely on this hardware interface.
The operational impact extends beyond simple data loss or disruption; it undermines the trust model of the entire embedded system. Since DJI devices are often used in professional commercial applications involving surveillance, mapping, and logistics, an attacker with local access could sabotage operations by altering time settings to desynchronize network communications or trigger shutdowns during critical flight preparations. This vulnerability highlights a fundamental design flaw where privileged services expose sensitive functionality through IPC interfaces without implementing robust security checks. To mitigate this risk, DJI must update the firmware to enforce strict permission verification within the onTransact() method of the DJIUpdateService binder. Developers should implement explicit checks using Android's checkCallingPermission or similar mechanisms before executing any transaction that modifies system state or accesses sensitive data. Additionally, applying the principle of least privilege by removing unnecessary exported services and restricting IPC access to only trusted applications is essential for securing future firmware releases against such unauthorized invocation attacks.