Vulnerabilidades do DJI CrystalSky ZS600C

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam DJI CrystalSky ZS600C: 5 registro(s), com versões afetadas e correções.

CVE-2026-114357 Crítica · 9.3 CWE-306 23/10/2026

DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)

Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).

CVE-2026-114356 Alta · 7.0 CWE-862 23/10/2026

DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.

CVE-2026-114355 Alta · 8.6 CWE-78 23/10/2026

DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root

OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.

CVE-2026-114354 Alta · 8.6 CWE-78 23/10/2026

DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root

Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.

CVE-2026-114353 Alta · 7.0 CWE-912 23/10/2026

DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution

Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().