# CVE-2026-114355: DJI CrystalSky ZS600C OS command injection in hardware_monitor

Source: https://junglewise.ai/threats/cve-2026-114355-os-command-injection-in-the-root-privileged-hardware-monitor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-114355 · Severity: info · Published 2026-10-23

The DJI CrystalSky ZS600C is an Android-based remote control for DJI drones. A vulnerability in its root-privileged hardware monitoring service allows any unprivileged app on the device to execute arbitrary commands as root by writing crafted messages to the system log, potentially enabling full device compromise and takeover of the drone.

Technologies: [DJI CrystalSky ZS600C](https://junglewise.ai/threats/technologies/crystalsky-zs600c). Vendors: [DJI](https://junglewise.ai/threats/vendors/dji).

## Quick answers

**Is CVE-2026-114355 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114355 being exploited in the wild.

**How severe is CVE-2026-114355?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** DJI CrystalSky ZS600C v0.3.9.7 through v0.6.6.9.

**Is there a fix for CVE-2026-114355?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-114355 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-114355?** Check whether you run DJI CrystalSky ZS600C at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The hardware_monitor helper runs as root and reads lines from Android's logcat, unsafely passing fields to a shell eval without sanitization. Any local process can write to logcat, enabling a local unprivileged attacker to inject shell metacharacters that the root process executes. This affects firmware v0.3.9.7 through v0.6.6.9, and the device is end-of-life with no further updates available.

## Affected products

- DJI CrystalSky ZS600C v0.3.9.7 through v0.6.6.9

## Timeline

- 2026-10-21: disclosed
- 2026-10-23: advisory

## References

- [https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114355](https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114355)

## Related threats

- [DJI CrystalSky ZS600C unauthenticated ADB access](https://junglewise.ai/threats/cve-2026-114357-missing-authentication-for-a-critical-function-in-the-android)
- [DJI CrystalSky ZS600C missing authorization in DJIUpdateService binder](https://junglewise.ai/threats/cve-2026-114356-missing-authorization-in-the-system-privileged-djiupdateservice)
- [DJI CrystalSky ZS600C arbitrary root command execution in binder service](https://junglewise.ai/threats/cve-2026-114354-missing-authorization-in-the-native-binder-service-android-dji)
- [DJI CrystalSky ZS600C hardcoded USB backdoor in assistant daemon](https://junglewise.ai/threats/cve-2026-114353-hidden-functionality-undocumented-backdoor-in-the-root)