The vulnerability is an OS command injection in the root‑privileged hardware_monitor helper of DJI CrystalSky ZS600C firmware. The helper reads lines written to the Android system log, then passes them directly to a shell eval. A local, unprivileged process can therefore inject a crafted log line that is executed as root. This permits an attacker with device access to run any command, fully compromising the system’s confidentiality, integrity, and availability.

Affected systems are DJI CrystalSky ZS600C drones running firmware versions 0.3.9.7 through 0.6.6.9 on Android. No later firmware is listed as affected, and the vulnerability does not apply to other DJI hardware.

The CVSS score of 8.6 indicates high severity. Because the exploit requires a local attacker to write a crafted line to the logcat, the attack surface is limited to physically accessible devices or compromised local processes. EPSS data is not available, and the flaw is not in the CISA KEV catalog. The vulnerability is best classified as a local privilege escalation that, if mitigated, would prevent arbitrary root execution.