CVE-2026-114357 DJI CVE debrief

Who should care

Defenders responsible for DJI CrystalSky ZS600C devices, particularly those using firmware versions between 0.3.9.7 and 0.6.6.9, should assess exposure and prioritize remediation. This vulnerability could allow attackers to gain unauthorized access to devices, potentially leading to further exploitation.

Why it matters

CVE-2026-114357 allows attackers to obtain unauthenticated shell access (uid 2000) on DJI CrystalSky ZS600C devices with firmware versions between 0.3.9.7 and 0.6.6.9. Defenders should verify exposure, restrict ADB access, and prioritize firmware updates from DJI.

• Unauthenticated shell access (uid 2000) could be used for further exploitation.
• Potential privilege escalation to root if additional vulnerabilities exist.
• Exposure of devices to network-based attacks if ADB is enabled over TCP.
• Need for verification of device firmware versions and remediation.

Technical summary

The DJI CrystalSky ZS600C firmware, versions 0.3.9.7 through 0.6.6.9, ships with the Android Debug Bridge (ADB) daemon (adbd) configured without authentication (ro.adb.secure=0). This allows an attacker to obtain an unauthenticated shell (uid 2000), which could be used as a foothold for privilege escalation to root. The device has USB ADB enabled by default, and while ADB over TCP is not enabled by default, it can be enabled (e.g., via the shipped /system/bin/adbd_tcp.sh or by setting 'persist.adb.tcp.port 5555'), making the unauthenticated shell reachable over the network.

Defensive priority

Defenders should prioritize verifying and remediating DJI CrystalSky ZS600C devices with firmware versions between 0.3.9.7 and 0.6.6.9, as they are potentially vulnerable to unauthenticated shell access via ADB.

Recommended defensive actions

• Verify DJI CrystalSky ZS600C devices with firmware versions between 0.3.9.7 and 0.6.6.9 for potential vulnerability.
• Disable ADB or restrict access to trusted networks and users.
• Monitor for and apply firmware updates from DJI.
• Consider implementing compensating controls, such as network monitoring and intrusion detection.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details about the vulnerability in DJI CrystalSky ZS600C firmware, which ships with ADB enabled and no authentication required. The device's ADB daemon (adbd) allows an attacker to obtain an unauthenticated shell (uid 2000), potentially leading to privilege escalation to root.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.