CVE-2026-114353: CrystalSky ZS600C 0.3.9.7 through 0.6.6.9

Affected technology

CrystalSky ZS600C · 0.3.9.7 through 0.6.6.9
DJI

Description’s affected range: through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0)

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Physical access · No privileges required · No user interaction required

What an attacker can do

A physically-present attacker with USB access can execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system(). Vendor/CNA’s CVSS 4.0 assessment (base score 7.0/10) rates confidentiality, integrity and availability impact as high.