CVE-2026-114353 DJI CVE debrief

Who should care

Organizations and individuals using DJI CrystalSky ZS600C devices with firmware versions between 0.3.9.7 and 0.6.6.9 should assess their exposure and take remediation steps. This includes verifying device firmware versions, securing devices against unauthorized USB access, and updating firmware when available.

Why it matters

CVE-2026-114353 is a high-severity vulnerability in DJI CrystalSky ZS600C devices that allows root command execution via a USB-gadget backdoor. Defenders should prioritize assessment and remediation efforts, focusing on securing devices against unauthorized USB access and updating firmware to non-vulnerable versions.

• Root command execution allows for complete control of the device, enabling attackers to modify configurations, extract sensitive data, or use the device as a pivot point for further attacks.
• Physically-present attackers with USB access can exploit this vulnerability without needing prior authentication or complex technical skills.
• Successful exploitation could lead to unauthorized access to sensitive data, disruption of critical operations, or compromise of connected systems.
• Verification of device firmware versions and configurations is necessary to determine if systems are vulnerable and to prioritize remediation efforts.

Technical summary

The 'assistant' daemon in DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9 contains a hidden backdoor that allows a physically-present attacker with USB access to execute arbitrary OS commands as root. The attacker must send the magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system(). This vulnerability allows for complete control of the device, enabling attackers to modify configurations, extract sensitive data, or use the device as a pivot point for further attacks.

Defensive priority

High-priority assessment and remediation recommended for affected DJI CrystalSky ZS600C devices with firmware versions between 0.3.9.7 and 0.6.6.9.

Recommended defensive actions

• Physically secure DJI CrystalSky ZS600C devices to prevent unauthorized USB access.
• Update firmware to a version outside the affected range (0.3.9.7 to 0.6.6.9) if available.
• Monitor for and restrict use of unauthorized USB devices with affected systems.
• Verify device firmware versions and configurations to ensure they are not vulnerable.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the hidden backdoor functionality in the 'assistant' daemon of DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9, allowing root command execution via a USB-gadget serial interface.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.