DJI CrystalSky ZS600C up to 0.6.6.9 assistant /dev/ttyGS0 system os command injection

Summaryinfo

A vulnerability, which was classified as very critical, has been found in DJI CrystalSky ZS600C up to 0.6.6.9. The affected element is the function system of the file /dev/ttyGS0 of the component assistant. Performing a manipulation results in os command injection. This vulnerability is reported as CVE-2026-114353. The attack requires a local approach. No exploit exists.

Detailsinfo

A vulnerability, which was classified as very critical, was found in DJI CrystalSky ZS600C up to 0.6.6.9. This affects the function system of the file /dev/ttyGS0 of the component assistant. The manipulation with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().

The advisory is shared at cyber-defence-campus.github.io. This vulnerability is uniquely identified as CVE-2026-114353 since 10/21/2026. The exploitability is told to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/23/2026). MITRE ATT&CK project uses the attack technique T1202 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• DJI

Name

• CrystalSky ZS600C

Version

• 0.6.6.0
• 0.6.6.1
• 0.6.6.2
• 0.6.6.3
• 0.6.6.4
• 0.6.6.5
• 0.6.6.6
• 0.6.6.7
• 0.6.6.8
• 0.6.6.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion