CVE-2026-114353

The record

Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().

Affected packages

Related vulnerabilities

• CVE-2026-118579 A weakness has been identified in D-Link DIR-505 1.10B02. CWE-912
• CVE-2026-15413 The Link Factory WordPress plugin is a backdoor. CWE-912
• CVE-2026-18844 The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands… CWE-912
• CVE-2026-17032 Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's… CWE-912
• CVE-2026-14812 The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that… CWE-912
• CVE-2026-11976 The official MonsterInsights Pro update distribution bucket… CWE-912
• CVE-2026-61515 Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command… CWE-912
• CVE-2026-18191 VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing… CWE-912