CVE-2026-114357
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI…
- Risk score
- 70/100
- CVSS
- 9.3 v4.0
- Exploit chance (30 days)
- 0.5%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware has missing authentication, allowing an attacker to obtain an unauthenticated shell and potentially escalate privileges to root.
- Affected
- {'products': ['DJI CrystalSky ZS600C'], 'packages': [], 'versions': ['v0.3.9.7', 'v0.4.6.9', 'v0.5.5.9', 'v0.6.6.9']}
- Fix
- Check the linked advisory for a fix, as none is provided.
- Exploitation
- No known exploitation
Not confirmed. 0.4.6.9, 0.5.5.9 isn't in the advisory. Check the vendor's advisory before acting on this.
Why it is Amber
- CVSS 9.3 critical
- Remotely exploitable without logging in
References
Original description
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).
Last activity 23 Oct 2026. Patch Forecast updates every hour.