Xav Ax8500 Firmware CVE-2025-5476

This vulnerability presents high real-world risk across multiple dimensions: (1) CVSS 8.8 with attack vector Adjacent Network (AV:A) indicates moderate physical proximity requirement but no privileges, credentials, or user interaction needed (PR:N/UI:N); (2) Access vector is practical in parking lots, garages, and Bluetooth-proximate environments; (3) Complete confidentiality, integrity, and availability impact (C:H/I:H/A:H) means attackers gain unrestricted device control including vehicle infotainment, potentially affecting climate control, navigation, and phone connectivity; (4) The lack of L2CAP isolation is a fundamental protocol-level flaw unlikely to be accidentally mitigated, increasing likelihood of exploitation; (5) As a ZDI disclosure (ZDI-CAN-26284), this vulnerability has undergone formal analysis and likely has proof-of-concept capability; (6) In-vehicle systems present high-value targets for theft, stalking, and vehicle tampering. EPSS would likely be elevated given the adjacency-only requirement and no-interaction nature.

An attacker with a laptop and Bluetooth adapter parks near a target vehicle containing an XAV-AX8500 system. Without any interaction from the vehicle owner, the attacker sends specially crafted L2CAP frames that exploit the channel isolation flaw to bypass authentication. Once authenticated, the attacker can read stored phone contacts and call history, modify navigation settings to redirect the driver, access stored WiFi credentials, or deny service by resetting the device—all while the owner remains unaware. A more targeted scenario involves an attacker preemptively establishing an unauthorized connection to a vehicle in a parking lot, then using stored credentials to lock the owner out of their own device during normal use, or inject malicious commands. The attack requires only Bluetooth proximity (typically 10-100 meters depending on antenna and environment) and a standard Bluetooth-capable computer, making it accessible to moderately skilled attackers.