# CVE-2026-114356: DJI CrystalSky ZS600C missing authorization in DJIUpdateService binder

Source: https://junglewise.ai/threats/cve-2026-114356-missing-authorization-in-the-system-privileged-djiupdateservice  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-114356 · Severity: info · Published 2026-10-23

DJI CrystalSky ZS600C is an Android-based remote controller for DJI drones used by professionals for industrial and mapping operations. A firmware vulnerability allows any locally installed app to perform privileged actions without permission, including factory reset, shutdown, time/timezone changes, and firmware installation—potentially disrupting operations or wiping data. The device is no longer receiving updates and is unsupported by the vendor.

Technologies: [DJI CrystalSky ZS600C](https://junglewise.ai/threats/technologies/crystalsky-zs600c). Vendors: [DJI](https://junglewise.ai/threats/vendors/dji).

## Quick answers

**Is CVE-2026-114356 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114356 being exploited in the wild.

**How severe is CVE-2026-114356?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** DJI CrystalSky ZS600C v0.3.9.7 through v0.6.6.9.

**Is there a fix for CVE-2026-114356?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-114356 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-114356?** Check whether you run DJI CrystalSky ZS600C at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The DJIUpdateService binder is a system-privileged Android service that exposes multiple sensitive operations (factory reset, shutdown, time change, firmware application) via transaction codes 101, 105, 123, 151, and 153, but performs no caller identity or permission verification in onTransact(). A local unprivileged app can invoke these transactions directly over IPC to execute privileged actions (CWE-862). The vulnerability has been verified non-destructively and affects firmware v0.3.9.7 through v0.6.6.9 with no patch expected due to device end-of-life.

## Affected products

- DJI CrystalSky ZS600C v0.3.9.7 through v0.6.6.9

## Timeline

- 2026-10-21: disclosed
- 2026-10-23: advisory

## References

- [https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114356](https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114356)

## Related threats

- [DJI CrystalSky ZS600C unauthenticated ADB access](https://junglewise.ai/threats/cve-2026-114357-missing-authentication-for-a-critical-function-in-the-android)
- [DJI CrystalSky ZS600C OS command injection in hardware_monitor](https://junglewise.ai/threats/cve-2026-114355-os-command-injection-in-the-root-privileged-hardware-monitor)
- [DJI CrystalSky ZS600C arbitrary root command execution in binder service](https://junglewise.ai/threats/cve-2026-114354-missing-authorization-in-the-native-binder-service-android-dji)
- [DJI CrystalSky ZS600C hardcoded USB backdoor in assistant daemon](https://junglewise.ai/threats/cve-2026-114353-hidden-functionality-undocumented-backdoor-in-the-root)