CVE-2026-114356: DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
Published Oct 23, 2026
·Updated
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.
Affected Software
1 affected component
DJI CrystalSky ZS600C>=0.3.9.7<=0.6.6.9
Event History
Oct 23, 2026
CVE Published
via MITRE·01:37 PM
Data Sourced
via MITRE·01:37 PM
DescriptionWeakness
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which devices should be considered affected?
DJI CrystalSky ZS600C devices running firmware versions v0.3.9.7 through v0.6.6.9 are affected.
2
What level of attacker access is required?
An attacker needs to run a local application on the device. The application does not need any Android permissions to invoke the exposed privileged binder operations.