Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2026-114353

DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
NCSC.ch

Description

Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

DJI CrystalSky ZS600C

Default version status: unaffected

  • 0.3.9.7 to ≤ 0.6.6.9affected

References