The flaw lies in the Android Debug Bridge daemon, which runs without requiring authentication on DJI CrystalSky ZS600C devices with firmware versions 0.3.9.7 through 0.6.6.9. Because the device ships with ro.adb.secure set to 0, an attacker can gain an unauthenticated ADB shell with UID 2000. This low‑privilege shell can be leveraged for privilege escalation to root, enabling full takeover of the device. The vulnerability is classified as authentication bypass and is rated CVSS 9.3, indicating a high potential for catastrophic impact if exploited.

DJI CrystalSky ZS600C, firmware v0.3.9.7 through v0.6.6.9. No other models or firmware versions are listed as affected.

The EPSS score is not available and the vulnerability has not been listed in the CISA KEV catalog, but the CVSS score of 9.3 signals a severe risk. USB and network‑based ADB connections are both possible; ADB over TCP is not enabled by default but can be activated via the shipped adbd_tcp.sh script or the setprop persist.adb.tcp.port 5555 command. Once enabled, the same unauthenticated shell is reachable over the network, providing an additional vector for remote exploitation. Attackers with physical or network access are thus able to establish an ADB session without any authentication, making this a low‑threshold, high‑impact attack.