Critical severity · published Oct 23, 2026
CVE-2026-114357
DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)
New
9.3
CVSS
0.3%
EPSS
No
On KEV
Description
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CZ
CrystalSky ZS600C · DJI
0.3.9.7 through 0.6.6.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114357
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114357
cyber-defence-campus.github.io
https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114357
More from CrystalSky ZS600C
8.6
CVE-2026-114355
DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root
8.6
CVE-2026-114354
DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
7.0
CVE-2026-114356
DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
7.0
CVE-2026-114353
DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution