CVE-2026-114354: DJI CrystalSky ZS600C arbitrary root command execution in binder service

CVE-2026-114354 · Severity: info · Published 2026-10-23

The DJI CrystalSky ZS600C is a remote controller for DJI drones; its firmware contains an unprotected system service that allows any locally installed application to execute commands with root privileges. An attacker can gain complete control of the device and any connected drones, leading to unauthorized access, data theft, or physical harm from compromised drone operations.

Technologies: DJI CrystalSky ZS600C. Vendors: DJI.

Quick answers

Is CVE-2026-114354 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-114354 being exploited in the wild.
How severe is CVE-2026-114354?
Informational severity, published 23 October 2026.
Which products and versions are affected?
DJI CrystalSky ZS600C v0.3.9.7 through v0.6.6.9.
Is there a fix for CVE-2026-114354?
No fixed version is recorded yet. No fix is available as the CrystalSky ZS600C is end-of-life and unsupported; users should discontinue use of the device or avoid installing untrusted applications while operating the system in isolated or air-gapped environments if continued use is necessary. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-114354 attacked?
It is attacked with local access, in device firmware.
Am I affected by CVE-2026-114354?
Check whether you run DJI CrystalSky ZS600C at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

No fix is available as the CrystalSky ZS600C is end-of-life and unsupported; users should discontinue use of the device or avoid installing untrusted applications while operating the system in isolated or air-gapped environments if continued use is necessary.

Technical details

The native binder service 'android.dji.server' exposes transaction code 1018 without authorization checks, passing caller-supplied strings directly to the system() function in the root-privileged 'assistant' daemon. A local application with zero Android permissions can exploit this to execute arbitrary OS commands as root. The vulnerability affects firmware v0.3.9.7 through v0.6.6.9, and no patch is available as the device is end-of-life and unsupported.

Affected products

  • DJI CrystalSky ZS600C v0.3.9.7 through v0.6.6.9

Timeline

  • 2026-10-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.