DJI CrystalSky ZS600C: Missing authentication in ADB daemon
Summary
The Android Debug Bridge daemon (adbd) on the DJI CrystalSky ZS600C, firmware v0.3.9.7 through v0.6.6.9, does not require authentication for a critical function. The device ships with ro.adb.secure=0 and USB ADB enabled by default, so an attacker with USB access can obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. If ADB over TCP is enabled, which is not the default, the same shell is reachable over the network without credentials.
Affected
- DJI CrystalSky ZS600C, firmware v0.3.9.7 through v0.6.6.9 (last release; device is end of life and unsupported)
Fixed in
Unknown.
Workaround
- Verify on each device that ADB over TCP is disabled and do not rely on the default alone
- Block the ADB TCP port at the network edge and place the device on an isolated network segment, not the office LAN or the internet
- Restrict physical access to the device and its USB port, because USB ADB is enabled by default
Exploitation
- No known exploitation at the time of writing (not listed as known exploited).
- No public exploit found.
- EPSS: 0.0031.
Our recommendation
- Check whether ADB over TCP is enabled on all devices and disable it if it is.
- Isolate the device from untrusted and shared networks and restrict USB access.
- Retire the device or replace it, since the firmware is end of life and no fix is confirmed.
- Ask DJI for a fix or firmware date and monitor for updates and related CVEs on this device (CVE-2026-114353, CVE-2026-114356).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cyber Defence Campus: Default-enabled unauthenticated ADB over USB cyber-defence-campus.github.io
- VulDB: CVE-2026-114357 vuldb.com
- Vulners NVD mirror: CVE-2026-114357 vulners.com
- Threatint CVE record: CVE-2026-114357 cve.threatint.com
- Strix: CVE-2026-114357 www.strix.ai
- HOL: CVE-2026-114357 hol.org
- OffSeq: CVE-2026-114357 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:47.
Original description (NVD)
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.