DJI CrystalSky ZS600C CVE-2026-114353

Requires local physical access to the device's USB-gadget serial interface (/dev/ttyGS0) on a CrystalSky ZS600C running firmware 0.3.9.7 through 0.6.6.9; the attacker sends the hard-coded magic string 'dji26656677' to unlock the backdoor, after which each line is executed via system() as root. No authentication or user interaction is needed once USB access exists (PR:N/UI:N). The decisive limiting factor is the physical-access requirement (AV:P): the flaw cannot be reached over a network, so fleets kept in continuous physical custody are not exposed, while devices that leave custody (shipping, loan, resale, shared use) are at risk.

All severity signals here are moderated by one dominant limiting factor: the attack vector is physical (CVSS 4.0 AV:P). The technical impact is severe - an intentional, undocumented backdoor (CWE-912) in a root-privileged daemon that yields arbitrary OS command execution as root, reflected in VC:H/VI:H/VA:H (equivalent to a 3.1 C:H/I:H/A:H). However, AV:P plus the need for hands-on USB access means this is neither automatable nor remotely scalable, which is why the composite CVSS 4.0 base score is only 7.0 rather than critical. No EPSS probability is provided and the CVE is not in CISA KEV, so there is no evidence of active exploitation; exploitation would be targeted and opportunistic (supply-chain, evil-maid, or device-handling scenarios) rather than widespread. The vuln.today decision label is this_week, consistent with a serious-but-not-emergency backdoor to address on a normal remediation cadence. Net: a genuine and alarming backdoor with high technical impact, but real-world risk is constrained by the physical-access precondition - prioritize for devices that leave physical custody, de-prioritize for physically controlled fleets.

An attacker who gains temporary physical custody of a CrystalSky ZS600C monitor (e.g. during shipping, loan, resale, or an evil-maid opportunity) connects to its USB-gadget serial interface, sends the hard-coded magic string 'dji26656677' to /dev/ttyGS0, then feeds shell commands that the assistant daemon passes directly to system() as root. A public technical write-up documenting the backdoor exists, though it is not verified as a packaged working exploit. Because the vector is physical (AV:P) with low complexity and no authentication, exploitation is trivial once USB access is obtained but cannot be performed remotely.