Quick answers
- Is CVE-2026-114356 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-114356 being exploited in the wild.
- How severe is CVE-2026-114356?
- Informational severity, published 23 October 2026.
- Which products and versions are affected?
- DJI CrystalSky ZS600C v0.3.9.7 through v0.6.6.9.
- Is there a fix for CVE-2026-114356?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-114356 attacked?
- It is attacked with local access, in device firmware.
- Am I affected by CVE-2026-114356?
- Check whether you run DJI CrystalSky ZS600C at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The DJIUpdateService binder is a system-privileged Android service that exposes multiple sensitive operations (factory reset, shutdown, time change, firmware application) via transaction codes 101, 105, 123, 151, and 153, but performs no caller identity or permission verification in onTransact(). A local unprivileged app can invoke these transactions directly over IPC to execute privileged actions (CWE-862). The vulnerability has been verified non-destructively and affects firmware v0.3.9.7 through v0.6.6.9 with no patch expected due to device end-of-life.
Affected products
- DJI CrystalSky ZS600C v0.3.9.7 through v0.6.6.9
Timeline
- 2026-10-21: disclosed
- 2026-10-23: advisory