The vulnerability consists of an undocumented backdoor embedded in the root‑privileged assistant daemon of DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9. An attacker with physical access to the device can send a hard‑coded magic string 'dji26656677' over the USB‑gadget serial interface (/dev/ttyGS0). After the backdoor is activated, every subsequent line the attacker sends is executed by the operating system using system(), granting the attacker the ability to run arbitrary commands with root privileges. This reflects a privilege escalation weakness, identified as CWE‑912.

The affected products are DJI CrystalSky ZS600C drones running firmware versions 0.3.9.7 through 0.6.6.9. The root‑privileged assistant daemon in these firmware releases contains the backdoor.

The CVSS score of 7 indicates a high severity of the vulnerability. Because the exploit requires a physical USB connection, the attack vector is local and the attacker must be able to connect a USB device to the drone. No EPSS score is available, and the vulnerability is not currently listed in the CISA KEV catalog, but the easy activation of the backdoor and the ability to run arbitrary commands as root mean that, once the attacker has physical access, exploitation is straightforward.