CVE-2026-114353: DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution

Q: Who can exploit this issue?

An attacker must be physically present and able to access the device over USB. The exposed interface is the USB-gadget serial device at /dev/ttyGS0.

Q: What must an attacker send to gain command execution?

The attacker first sends the hard-coded string dji26656677 to the USB-gadget serial interface. After that, each subsequent line is passed to system() by a root-privileged daemon, enabling root-level OS command execution.

Q: Which firmware versions are affected?

The issue affects DJI CrystalSky ZS600C firmware versions v0.3.9.7 through v0.6.6.9 on Android.

Published Oct 23, 2026

Updated

Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().

Affected Software

1 affected component

DJI CrystalSky ZS600C>=0.3.9.7<=0.6.6.9

Event History

Oct 23, 2026

CVE Published

via MITRE·01:31 PM

Data Sourced

via MITRE·01:31 PM

DescriptionWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be physically present and able to access the device over USB. The exposed interface is the USB-gadget serial device at /dev/ttyGS0.

What must an attacker send to gain command execution?

The attacker first sends the hard-coded string dji26656677 to the USB-gadget serial interface. After that, each subsequent line is passed to system() by a root-privileged daemon, enabling root-level OS command execution.

Which firmware versions are affected?