CVE-2026-114353 Details
Description
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().
A hidden backdoor has been identified in the root-privileged 'assistant' daemon of the DJI CrystalSky ZS600C, within firmware versions 0.3.9.7 to 0.6.6.9. This backdoor allows a physically-present attacker with USB access to execute arbitrary operating system commands as root. The exploitation involves sending a hard-coded magic string, 'dji26656677', to the USB-gadget serial interface (/dev/ttyGS0). Once the magic string is received, each subsequent line is executed as a command via the system() function.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114353 | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-912 | Hidden Functionality | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DJI CrystalSky ZS600C | >= 0.3.9.7, <= 0.6.6.9 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |