DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
The DJI CrystalSky ZS600C tablet's Android system firmware is affected, specifically its DJIUpdateService component. A local app with no special permissions could use it to perform privileged actions such as wiping all user data, shutting down the device, changing the clock and timezone, and applying firmware updates.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- DJI CrystalSky ZS600C
From 0.3.9.7 · through 0.6.6.9