CVE-2026-114356: DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization

Q: Which devices should be considered affected?

DJI CrystalSky ZS600C devices running firmware versions v0.3.9.7 through v0.6.6.9 are affected.

Q: What level of attacker access is required?

An attacker needs to run a local application on the device. The application does not need any Android permissions to invoke the exposed privileged binder operations.

Published Oct 23, 2026

Updated

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.

Affected Software

1 affected component

DJI CrystalSky ZS600C>=0.3.9.7<=0.6.6.9

Event History

Oct 23, 2026

CVE Published

via MITRE·01:37 PM

Data Sourced

via MITRE·01:37 PM

DescriptionWeakness

Frequently Asked Questions

Which devices should be considered affected?

DJI CrystalSky ZS600C devices running firmware versions v0.3.9.7 through v0.6.6.9 are affected.

What level of attacker access is required?

An attacker needs to run a local application on the device. The application does not need any Android permissions to invoke the exposed privileged binder operations.

CVE-2026-114356: DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization

Affected Software

Event History

Frequently Asked Questions

Which devices should be considered affected?

What level of attacker access is required?

Company

Resources

Contact

Frequently Asked Questions

Which devices should be considered affected?

What level of attacker access is required?