CVE-2026-114353
Description
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().
Is your site exposed to CVE-2026-114353?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2026-114353? +
How do I check if I'm vulnerable to CVE-2026-114353? +
Related Vulnerabilities
An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not …
The "update" binary in the firmware of the affected product sends attempts to mount to a hard-coded, routable IP address, …
A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 …
Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located …
Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthorized …
A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets …