Vulnerability feed

Executive summary

A missing authentication flaw in the Android Debug Bridge daemon on DJI CrystalSky ZS600C devices lets an attacker obtain a shell without logging in. The advisory gives a CVSS 4.0 base score of 9.3, which indicates critical severity. The advisory does not state a vendor fix or recommended remediation.

Technical summary

The flaw is missing authentication for a critical function in adbd, which allows an unauthenticated shell running as uid 2000 and a foothold for privilege escalation to root. The affected firmware range is v0.3.9.7 through v0.6.6.9. The device ships with ro.adb.secure=0 and USB ADB enabled by default, so USB access is one preconditions path. ADB over TCP is not enabled by default but can be enabled through /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555', after which the shell is reachable over the network. The advisory does not state a fixed version, a workaround, exploitation status, or detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

None

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

Affects

DJIDJI CrystalSky ZS600C

Executive summary

DJI CrystalSky ZS600C tablets running firmware v0.3.9.7 through v0.6.6.9 on Android contain a flaw that lets any locally installed app with no special permissions perform privileged system actions. The advisory rates it High, with a CVSS-style score of 7.0, and notes the device is end-of-life and unsupported. The advisory does not state a vendor fix or patch.

Technical summary

The flaw is missing authorization (CWE-862) in the system-privileged DJIUpdateService binder, whose onTransact() method performs no caller-identity or permission check. A local application with no permissions can call transactions 101 and 123 (clock and timezone change), 105 (shutdown), 153 (factory reset with user-data wipe), and 151 (firmware-apply hand-off). Affected firmware is stated as v0.3.9.7 through v0.6.6.9, described as the last release. The advisory does not state a fixed version, a workaround, or any mitigation for the end-of-life device. It reports non-destructive verification in which code 101 changed the system clock. No detection guidance or evidence of exploitation in the wild is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from cyber-defence-campus.github.io/projects…ties/CVE-2026-114356

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Attack requirements

None

Privileges required

None

User interaction

None

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

Affects

DJIDJI CrystalSky ZS600C

Executive summary

A local flaw in the DJI CrystalSky ZS600C tablet firmware, versions v0.3.9.7 through v0.6.6.9, lets a program already running on the device run commands with root privileges. The advisory rates it High with a CVSS-style score of 8.6, and states that the device is end-of-life and unsupported, so no fixed release is stated.

Technical summary

This is an OS command injection flaw in the root-owned hardware_monitor helper on Android. The helper reads lines from logcat and passes a field from each line to a shell eval, and any process on the device can write to logcat, so a local unprivileged process can inject a command that the root helper runs. The affected range is firmware v0.3.9.7 through v0.6.6.9, with v0.6.6.9 described as the last release. The advisory states that the vendor has no fixed version and that the device is EOL/unsupported, so no patch is available. No workaround is stated, and no detection guidance is given. The advisory says the issue was verified on device with uid=0.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from cyber-defence-campus.github.io/projects…ties/CVE-2026-114355

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Attack requirements

None

Privileges required

None

User interaction

None

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

Affects

DJIDJI CrystalSky ZS600C

Executive summary

A flaw in DJI CrystalSky ZS600C tablet firmware, versions v0.3.9.7 through v0.6.6.9, lets any locally installed app with no permissions run commands with full system control. The advisory rates it High, with a score of 8.6. The advisory states the device is end-of-life and unsupported, so no vendor fix is described; it is not stated whether any fix or workaround exists.

Technical summary

This is a missing authorization flaw in the native binder service 'android.dji.server' (transaction code 1018), which runs under a root-privileged assistant daemon. The transaction passes a caller-supplied string directly to system() without checking the caller's identity or permissions. Any locally installed application with zero permissions can trigger it and run arbitrary OS commands as root, and the advisory says this was verified from a permissionless APK with uid=0. Affected firmware is v0.3.9.7 through v0.6.6.9, described as the last release. No fixed version, workaround, or detection guidance is stated, and the advisory notes the device is EOL/unsupported.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from cyber-defence-campus.github.io/projects…ties/CVE-2026-114354

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Attack requirements

None

Privileges required

None

User interaction

None

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

Affects

DJIDJI CrystalSky ZS600C

Executive summary

The DJI CrystalSky ZS600C tablet, running firmware v0.3.9.7 through v0.6.6.9, contains a hidden backdoor that lets someone with physical USB access run commands on the device as the system administrator without logging in. The advisory rates the severity as High, with a score of 7.0. The advisory states the device is end-of-life and unsupported, so no vendor fix is stated; the only stated recommendation is that the device is no longer supported.

Technical summary

The flaw is an undocumented backdoor, classed as hidden functionality, in the root-privileged 'assistant' daemon. The daemon listens on the USB-gadget serial port /dev/ttyGS0 and, after receiving the hard-coded string dji26656677, passes each following line to system() as root. The attack requires physical USB access and no authentication. Affected firmware is stated as v0.3.9.7 through v0.6.6.9, which the advisory describes as the last release. A fixed version is not stated because the device is end-of-life. A workaround is not stated, and no detection guidance is provided. The advisory reports the issue was verified on the device with uid=0. The CVSS vector and any exploitation in the wild are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from cyber-defence-campus.github.io/projects…ties/CVE-2026-114353

Impact if exploited

How it is exploited

Attack vector

Physical

Attack complexity

Low

Attack requirements

None

Privileges required

None

User interaction

None

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

Affects

DJIDJI CrystalSky ZS600C