CVE-2026-114354 DJI CVE debrief

Who should care

Defenders responsible for DJI CrystalSky ZS600C devices, particularly those using firmware versions from 0.3.9.7 to 0.6.6.9, should assess exposure and apply patches or updates to prevent potential local application exploitation.

Why it matters

CVE-2026-114354 allows local applications to execute arbitrary OS commands as root on DJI CrystalSky ZS600C devices with vulnerable firmware versions. Defenders should assess exposure, verify firmware versions, and apply patches to prevent potential exploitation.

• Local application exploitation could lead to arbitrary OS command execution as root
• Potential for privilege escalation and unauthorized access
• Risk of device compromise and data exposure
• Need for verification of firmware versions and patch application

Technical summary

The native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware versions from 0.3.9.7 to 0.6.6.9 lacks authorization, allowing a local application with no permissions to execute arbitrary OS commands as root. This vulnerability is due to the service passing a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check. The vulnerability can lead to arbitrary OS command execution as root, allowing for potential privilege escalation and unauthorized access. Defenders should assess exposure, verify firmware versions, and apply patches to prevent potential exploitation.

Defensive priority

High

Recommended defensive actions

• Assess exposure of DJI CrystalSky ZS600C devices with firmware versions from 0.3.9.7 to 0.6.6.9
• Verify if devices are running vulnerable firmware versions
• Apply vendor-provided patches or updates to fix the vulnerability
• Monitor for potential local application exploitation attempts
• Perform regular security audits to identify and address potential vulnerabilities
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track and document changes to the system to ensure accountability and facilitate incident response.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and CVSS score. However, there is limited information on potential exploits or impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.