DJI CrystalSky ZS600C CVE-2026-114356

Exploitation requires a locally installed Android application on a DJI CrystalSky ZS600C running firmware v0.3.9.7 through v0.6.6.9; the malicious app needs no permissions and no user interaction because the DJIUpdateService binder is reachable and its onTransact() performs no caller-identity or permission check. The concrete prerequisite is simply getting any app onto the device (side-load or store install). Limiting factors that reduce real-world risk: there is no remote vector - the attacker must already have code running locally on the specific device model and firmware range; exploitation does not affect other systems (no scope spillover beyond the device), and impact is confined to destructive/disruptive actions (factory reset, shutdown, clock/timezone change, firmware-apply hand-off) with no confidentiality exposure.

This is a genuine but access-gated local privilege/authorization flaw rather than a mass-exploitable remote issue. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) confirms a local attack surface requiring no privileges and no user interaction, which matches the description: any installed Android app - even one holding zero permissions - can reach the exported system-privileged DJIUpdateService binder. Impact is skewed to integrity and availability (VI:H/VA:H) with no confidentiality loss (VC:N), consistent with destructive operations (factory reset/user-data wipe, shutdown, clock/timezone change, firmware-apply hand-off) rather than data theft. The vuln.today decision label is 'this_week', indicating prompt but not emergency handling. No EPSS score, no CISA KEV listing, and no confirmed working exploit are provided, so there is no evidence of widespread or automated exploitation; the single reference is a vendor-independent research write-up (Cyber Defence Campus / NCSC.ch) that documents the exact binder transaction codes. Net: a real and credible local-attacker risk on a niche device, worth remediating, but the local-only vector and specialized affected product keep real-world exploitation volume low compared to the 7.0 HIGH severity.

A user side-loads or installs a seemingly benign third-party app on a DJI CrystalSky ZS600C monitor running affected firmware. Because the DJIUpdateService binder's onTransact() enforces no caller check, the app silently binds to the system service and issues transaction 153, factory-resetting the device and wiping all user data, or 105 to force a shutdown. A public technical write-up documenting the exact transaction codes exists, lowering the effort required to reproduce the attack; the low attack complexity and lack of required permissions make it reliable once an app is on the device.