CVE-2026-114355

The record

OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.

Affected packages

Related vulnerabilities

• CVE-2026-62853 ThingLinks is an enterprise IoT platform. CWE-78
• CVE-2026-119335 Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing… CWE-78
• CVE-2026-116241 pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO… CWE-78
• CVE-2026-119713 Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability… CWE-78
• CVE-2026-119288 Zuke is a code-first, strongly typed build automation system for Deno. CWE-78
• CVE-2026-118238 The Tenda W18E web management server is vulnerable to OS command injection via the… CWE-78
• CVE-2026-91913 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization… CWE-78
• CVE-2026-118992 CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell… CWE-78