The firmware exposes the DJIUpdateService binder without performing any caller‑identity or permission checks. A local application that does not request any Android permissions can therefore invoke privileged transactions such as factory reset, device shutdown, clock or timezone modification, and hand‑off of firmware updates. These operations give the attacker full control over the device state and data, representing a direct elevation of local privileges.

DJI CrystalSky ZS600C units running Android firmware versions 0.3.9.7 through 0.6.6.9 are affected. The vulnerability resides in the system‑privileged binder service of these firmware releases.

The CVSS score of 7.0 indicates a high severity of the flaw. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting no confirmed public exploitation yet. Nevertheless, the lack of authorization allows any local process—whether legitimate or malicious—to perform critical actions, making it an attractive target for insider misuse or compromised apps. The likely attack vector is local, requiring the attacker to have access to the device or the ability to install an unmodified app.