CVE-2026-114356
Deferred Deferred - Pending Action

Missing Authorization in DJI CrystalSky ZS600C Firmware

Publication date: 2026-10-23

Last updated on: 2026-10-23

Assigner: Switzerland Government Common Vulnerability Program

Description
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-23
Last Modified
2026-10-23
Generated
2026-10-24
AI Q&A
2026-10-23
EPSS Evaluated
N/A
NVD
CVE-2026-114356
EUVD
EUVD-2026-108988

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
DJI CrystalSky ZS600C 0.3.9.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Missing authorization in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows a local app with no permissions to invoke privileged operations via the system-privileged 'DJIUpdateService' binder. Operations include factory reset with user-data wipe, shutdown, clock/timezone changes, and firmware updates due to missing caller-identity or permission checks in onTransact().

Detection Guidance

To detect this vulnerability, check for unauthorized privileged operations by the DJIUpdateService binder. Verify if transaction 101 (clock/timezone change) or other transactions (105, 151, 153) can be triggered by a local app without permissions. Use Android debugging tools like 'adb shell' to inspect binder transactions and service calls.

Impact Analysis

An attacker with local access could perform unauthorized actions like wiping your device, shutting it down, changing system time, or installing malicious firmware without your consent. This could lead to data loss, device unavailability, or compromise of device functionality.

Compliance Impact

This vulnerability could lead to unauthorized data deletion or modification, violating GDPR's integrity and availability principles or HIPAA's safeguards for protected health information. Organizations using affected devices may fail compliance audits due to insufficient access controls.

Mitigation Strategies

Update DJI CrystalSky ZS600C firmware to the latest version beyond v0.6.6.9 to address the missing authorization in DJIUpdateService. Disable or restrict local applications from interacting with DJIUpdateService until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114356. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart