{"schema":"threatline.record/2","record":{"id":"CVE-2026-114354","aliases":[],"summary":"DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root","details":"Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.","categories":["Unclassified"],"product":"CrystalSky ZS600C","vendor":"DJI","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114354","source_modified_at":"2026-10-23T13:33:36.131Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"CrystalSky ZS600C","vendor":"DJI","versions":[{"status":"affected","version":"0.3.9.7","lessThanOrEqual":"0.6.6.9","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.6,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T13:33:36.131Z","modified_at":"2026-10-23T13:33:36.131Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-114354","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T13:33:36.131Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114354","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T13:33:36.131Z","content_hash":"955a095f294c2acd31e10a7cc2fcf44f3f73524a321ac0a1908f663045f57634"}}