DJI CrystalSky CVE-2026-114354

Requires the attacker to execute a local application (needing no Android permissions and no user interaction) on a DJI CrystalSky ZS600C device running firmware v0.3.9.7 through v0.6.6.9; the app must reach the native binder service 'android.dji.server' and invoke transaction code 1018, whose handler forwards the caller-supplied string to system() in the root 'assistant' daemon with no caller-identity or permission check. Limiting factors that reduce real-world risk: the attacker must already be able to run code on the physical device (local vector only, no network reachability), the flaw is confined to the listed firmware range, and the target is specialized DJI drone-control hardware rather than general-purpose or internet-facing infrastructure. No fixed firmware version is provided in the available data.

The reported CVSS 4.0 base score is 8.6 (High), driven by a HIGH technical impact (VC:H/VI:H/VA:H - arbitrary OS command execution as root) combined with a trivially reachable trigger (AC:L, AT:N, PR:N, UI:N). The decisive mitigating signal is the attack vector: AV:L means exploitation requires an attacker to already be able to run code locally on the CrystalSky ZS600C device - this is a local privilege-escalation flaw, not a remotely reachable one. No CISA KEV listing is present, so there is no confirmed active exploitation, and no EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified from the input. The vuln.today decision label is 'this_week' (not act_now/emergency), which is consistent with a severe-but-locally-gated flaw. These signals are coherent rather than conflicting: high impact and low attack complexity pull toward urgency, while the local-only vector and a niche, specialized target product pull against mass-exploitation risk. Net assessment: a genuine high-severity privilege-escalation issue that matters most to organizations actually operating DJI CrystalSky ZS600C hardware, but not a broad internet-facing emergency. Note that no vendor (DJI) advisory or fixed firmware version is present in the input, so remediation status is unverified.

A malicious or trojanized Android application - installed or sideloaded onto the CrystalSky ZS600C monitor, requiring no Android permissions - issues binder transaction code 1018 to the 'android.dji.server' service. The root-privileged 'assistant' daemon passes the caller-supplied string straight to system() with no caller-identity or permission check, so the attacker's command runs as root and yields full device takeover. A public research write-up describing the flaw exists (Cyber Defence Campus / NCSC.ch), though it is not verified in the input as working exploit code.