Horizon Alert
Summary of the vulnerability and why it matters
The Android Debug Bridge daemon in DJI CrystalSky firmware contains a critical vulnerability that allows an attacker to gain unauthorized shell access, potentially leading to elevated privileges. This issue is present in specific firmware versions and is reachable both via USB and, if enabled, over the network.
- Unauthenticated shell access to the device.
- Critical vulnerability could allow system compromise.
- Assess relevance and exposure for security oversight.
Attack Path
How an attacker could exploit the issue
An attacker could gain access to a device through its USB port or, if enabled, over the network. This access allows them to interact with the Android Debug Bridge daemon, a component that handles debugging commands. By exploiting a flaw in this daemon, an attacker can bypass authentication and obtain a shell, providing a starting point for further actions on the device.
- Unauthenticated shell access is possible.
- Triggered via an unauthenticated ADB connection.
- Enables foothold for privilege escalation.
Live Threat
Current exploitation, exposure, and threat context
The Android Debug Bridge daemon in DJI CrystalSky firmware could allow an unauthenticated attacker to gain shell access. This could happen when ADB is enabled, either via USB or, when explicitly configured, over the network. The compromised shell runs with user ID 2000, which is a potential stepping stone for further privilege escalation.
- Unauthenticated shell access to the device.
- ADB enabled over USB or network.
- Foothold for privilege escalation.
Operational Fix
Recommended remediation, mitigation, and detection steps
The DJI CrystalSky ZS600C firmware's missing authentication in ADBd presents a critical risk, potentially allowing unauthenticated shell access and privilege escalation. Owners of these devices, likely consumers or specialized field operators, must first identify all units and assess their network exposure and business criticality. Planning remediation should prioritize risk-based strategies, considering the default ADB configuration and the ease of network activation.
- Identify device inventory and exposure.
- Verify ADB network reachability and criticality.
- Plan targeted remediation for high-risk devices.
