CVE-2026-114357: CWE-306 Missing Authentication for Critical Function in DJI CrystalSky ZS600C

The vulnerability arises from the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9, which lacks authentication for critical functions. The device is configured with ro.adb.secure=0, disabling host key authorization, and USB ADB is enabled by default. This allows an attacker with physical access to obtain an unauthenticated shell (uid 2000), which can be used as a foothold for privilege escalation to root. Additionally, if ADB over TCP is enabled (e.g., via the provided adbd_tcp.sh script or setting persist.adb.tcp.port to 5555), the unauthenticated shell is accessible remotely over the network. The CVSS 4.0 base score is 7, indicating high severity.

An attacker can gain an unauthenticated shell on the affected device, providing a foothold for privilege escalation to root. This compromises device integrity and security. The vulnerability is exploitable locally via USB ADB by default and remotely if ADB over TCP is enabled, increasing the attack surface.

No official patch or fix information is provided. Users should disable USB ADB if not needed and avoid enabling ADB over TCP. Monitor vendor advisories for updates or patches addressing this vulnerability. Since the device ships with insecure default settings, hardening device configuration is recommended until an official fix is available.