CVE-2026-114355: fallo de gravedad alta en DJI CrystalSky ZS600C
DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.6epss 1.2%
OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P
Productos afectados
DJI · CrystalSky ZS600CCVEs relacionadas — DJI CrystalSky ZS600C
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-114357HIGHDJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)EPSS 0.3%CVE-2026-114353HIGHDJI CrystalSky ZS600C USB-gadget backdoor allows root command executionEPSS 0.2%CVE-2026-114354HIGHDJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as rootEPSS 0.1%CVE-2026-114356HIGHDJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorizationEPSS 0.1%