CVE-2026-114355 DJI CVE debrief

Who should care

System administrators and security teams responsible for managing and securing DJI CrystalSky ZS600C devices should assess exposure and apply necessary updates or mitigations to prevent potential system compromise and data breaches. They should also review system logs for suspicious activity and verify if devices are running vulnerable firmware versions.

Why it matters

CVE-2026-114355 is a high-severity vulnerability in DJI CrystalSky ZS600C firmware that allows local unprivileged processes to execute arbitrary commands as root. This vulnerability requires immediate attention from system administrators and security teams to assess exposure and apply necessary updates or mitigations.

• Local privilege escalation to root
• Execution of arbitrary commands
• Potential for system compromise

Technical summary

The 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9 is vulnerable to OS command injection. A local unprivileged process can execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval. This vulnerability has significant operational impacts, including local privilege escalation to root, execution of arbitrary commands, and potential for system compromise. The vulnerability is highly severe, with a CVSS score of 8.6.

Defensive priority

High

Recommended defensive actions

• Assess exposure of DJI CrystalSky ZS600C devices running firmware versions 0.3.9.7 through 0.6.6.9
• Verify if devices are running vulnerable firmware versions
• Apply firmware updates if available
• Monitor system logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the OS command injection vulnerability in the 'hardware_monitor' helper of DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9. The vulnerability allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat). Evidence is based on CVE Program and NVD sources, with limited additional context available. Further verification is recommended to confirm affected deployments and assess potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.