DJI CrystalSky CVE-2026-114355

Requires: (1) the affected DJI CrystalSky ZS600C firmware in the range 0.3.9.7 through 0.6.6.9, where the root-privileged hardware_monitor helper reads logcat and passes input to a shell eval; and (2) an attacker who already has an unprivileged local process/app running on the device that is able to write entries to the Android log (logcat). Limiting factors that reduce real-world risk: the attack vector is strictly local (no network/remote path), so the attacker must first obtain code execution on the device by another means; it does not work remotely or against a device with no attacker-controlled process. No user interaction by a victim is required once the foothold exists.

The published CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 8.6) scores high, but every signal points to a local privilege-escalation primitive, not a remotely exploitable flaw: AV:L means the attacker must already have code running on the CrystalSky device, and the described prerequisite - a 'local unprivileged process' that can write to logcat - means this is used to escalate from an unprivileged app to root, not to gain initial access. The vuln.today Decision label is 'this_week' (not act_now/emergency), which is consistent with a serious-but-not-mass-exploited local issue. No CISA KEV listing is present (not actively exploited per the input), and no EPSS probability was supplied, so widespread automated exploitation cannot be inferred. Against that, the technical impact is total (full root: VC/VI/VA all High) and attack complexity is low. Net: a genuine high-severity local root escalation on a niche device that is a real priority for anyone operating the affected firmware, but it is not an internet-facing emergency and depends on an attacker first achieving unprivileged code execution on the device. Note a discrepancy to verify: the published vector uses PR:N while the description requires an already-running local unprivileged process, which is better modeled as PR:L - see assessed vector below. No vendor (DJI) advisory or fixed version is present in the supplied data.

A malicious or compromised unprivileged Android app running on the DJI CrystalSky ZS600C writes a specially crafted line into the Android system log; the root-privileged hardware_monitor helper reads that line from logcat and passes it to a shell eval, executing the attacker's commands as root. A public technical write-up (Cyber Defence Campus / NCSC.ch) describes the flaw, giving attackers a detailed blueprint, though it is not confirmed as packaged working exploit code. Because the CVSS attack vector is local (AV:L) with low complexity (AC:L), exploitation is straightforward once an unprivileged process foothold exists on the device.