A local Android application lacking any permissions can reach the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9. The service accepts a free-form string and forwards it to system() inside the root‑privileged assistant daemon without checking the caller’s identity or permissions, allowing arbitrary OS commands to run with root privileges. This flaw is identified as command injection (CWE‑78) and is further amplified by missing authentication (CWE‑862).

The vulnerability affects DJI’s CrystalSky ZS600C drones running firmware versions 0.3.9.7 up to and including 0.6.6.9 on the Android platform.

The CVSS base score of 8.6 indicates high severity. The EPSS score is not available, so current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. A local attacker can exploit the flaw by simply executing the binder transaction from any app, so the attack vector is local and does not require network access. Because the attacker gains root permissions, the impact includes full system compromise, allowing modification of firmware, persistence, and further attacks.