CVE-2026-114356 Details
Description
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.
A vulnerability exists in the system-privileged 'DJIUpdateService' binder on DJI CrystalSky ZS600C devices running firmware versions 0.3.9.7 through 0.6.6.9. The issue arises because the 'onTransact()' method does not perform any caller-identity or permission checks, allowing local applications with no permissions to invoke privileged operations. These operations include factory reset with user-data wipe, shutdown, changing the clock or timezone, and initiating the firmware-apply hand-off.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114356 | [email protected] | AdvisoryTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DJI CrystalSky ZS600C | >= 0.3.9.7, <= 0.6.6.9 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |