CVE-2026-114357: CrystalSky ZS600C 0.3.9.7 through 0.6.6.9

Affected technology

CrystalSky ZS600C · 0.3.9.7 through 0.6.6.9
DJI

Description’s affected range: through v0.6.6.9

Component: Not specified by the source
Function: in

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker can obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. Vendor/CNA’s CVSS 4.0 assessment (base score 9.3/10) rates confidentiality, integrity and availability impact as high.