Zero Radar
← feed
CriticalVulnerabilityCVE-2026-114357updated 25 Oct 2026, 17:20 UTC

DJI CrystalSky tablet lets anyone with access get a remote shell

Anyone who can plug a cable into the CrystalSky, or reach it over the network once a debug feature is turned on, can get command-line control of the device without a password. That is a serious takeover risk.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker nearbyHas USB cable or network access
  2. 2ADB reachableUSB default, or TCP port 5555 once enabled
  3. 3adbd accepts connectionNo authentication is required
  4. 4Unauthenticated shellRuns as uid 2000
  5. 5Privilege escalationShell used as a path to root
  6. ResultAttacker gains command control of device

What happened

The Android Debug Bridge daemon (adbd) on DJI CrystalSky ZS600C firmware lacks authentication for a critical function, so an unauthenticated shell (uid 2000) can be obtained over USB by default or over TCP once ADB networking is enabled.

Why it is dangerous: An attacker can run commands on the device and use that foothold to attempt privilege escalation to root. Anyone operating a CrystalSky on a network where ADB over TCP is enabled, or with physical USB access, is at risk.

Are you affected?

You are affected if you run DJI CrystalSky ZS600C with firmware v0.3.9.7 through v0.6.6.9.

DJI CrystalSky ZS600C, firmware v0.3.9.7 through v0.6.6.9

What to do

  1. Check whether ADB over TCP is enabled on the device and turn it off if it is not needed (persist.adb.tcp.port should not be 5555).
  2. Restrict physical USB access to the device and avoid connecting it to untrusted computers.
  3. Watch for DJI's firmware update that addresses this issue and install it as soon as it is released.

Timeline

  1. 23 Oct 2026, 14:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 14:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-114357 · GHSA-826v-5gj2-v5c8
CVSS
9.3 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 14:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

DJI CrystalSky tablet lets anyone with access get a remote shell · Zero Radar