PULSEUnderground Intel

EN VIVO13señales / 24h

FEED

ransomqilin reclama a ECOM · CH · Retail & E-Commerceransomemperador reclama a AyT COMPUTERS SRL · Technologyransomqilin reclama a ETO · DE · Not Foundransomn0n reclama a TOPLIVO AD · BG · Energy & Utilitiesransomn0n reclama a Technoleads Services Inc. · Technologyransomn0n reclama a Pure Grow Diamonds Inc. · Manufacturingransomn0n reclama a Mach Law APC (San Diego family law and divorce practice) · US · Professional Servicesransomn0n reclama a Keidel Supply Company Incorporated · US · Manufacturingransomn0n reclama a Andrews Advisory Group LLC · US · Professional Servicesransomemperador reclama a AB InBev · BE · Agriculture and Food Productionransomwhitearmor reclama a Hisense · CN · Technologyransomanubis reclama a Newcomer Cremations, Funerals & Receptions · US · Healthcareransomqilin reclama a Castle Howard Estate · GB · Hospitalityransomlamashtu reclama a Vins Viallet · FR · Retail & E-Commerceransomqilin reclama a ECOM · CH · Retail & E-Commerceransomemperador reclama a AyT COMPUTERS SRL · Technologyransomqilin reclama a ETO · DE · Not Foundransomn0n reclama a TOPLIVO AD · BG · Energy & Utilitiesransomn0n reclama a Technoleads Services Inc. · Technologyransomn0n reclama a Pure Grow Diamonds Inc. · Manufacturingransomn0n reclama a Mach Law APC (San Diego family law and divorce practice) · US · Professional Servicesransomn0n reclama a Keidel Supply Company Incorporated · US · Manufacturingransomn0n reclama a Andrews Advisory Group LLC · US · Professional Servicesransomemperador reclama a AB InBev · BE · Agriculture and Food Productionransomwhitearmor reclama a Hisense · CN · Technologyransomanubis reclama a Newcomer Cremations, Funerals & Receptions · US · Healthcareransomqilin reclama a Castle Howard Estate · GB · Hospitalityransomlamashtu reclama a Vins Viallet · FR · Retail & E-Commerce

← Todos los CVEs

CVE Watch23 oct 2026

CVE-2026-114353

Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0

CVSS

—

Sin CVSS

EPSS

0.2%

p5

KEV

—

Exploit Today

1

0-100

Publicado: 23 oct 2026 · Última mod.: 23 oct 2026 · CWE-912

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().

Referencias oficiales

cyber-defence-campus.github.iohttps://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-114353

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-976277.2 ALT

——9Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands.5d CVE-2026-1007374.9 MED

——5Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware.5d CVE-2026-1123608.0 ALT

——12A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.5d CVE-2026-828299.8 CRÍ

——6Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized access by exploiting hidden accounts or hard coded credentials. This issue affects Hitachi Coding Software Suite: through 3.3.0.24d CVE-2026-802178.8 ALT

——13Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands.39d CVE-2026-1541310.0 CRÍ

——13The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).60d