EUVD-2026-63430
GHSA-j2pg-r74g-f5v5
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Physical USB connection required (AV:P); no credentials needed (PR:N); only low integrity impact as restricted device types are instantiated but no confidentiality or availability impact applies.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
1DescriptionCVE.org
Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected installations on Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the udev rules. A crafted USB device connected to the system can trigger instantiation of otherwise restricted USB device types. An attacker can leverage this vulnerability to bypass authorization on the system. Was ZDI-CAN-28992.
AnalysisAI
Authorization bypass in the Sony XAV-9500ES in-car media receiver allows a physically present attacker to connect a crafted USB device that triggers instantiation of otherwise restricted USB device types, circumventing the unit's udev-based authorization controls. Firmware version 3.02.00 of the XAV-9500ES is confirmed affected per EUVD-2026-63430. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation unconditionally requires the attacker to be physically present and able to connect a USB device to the XAV-9500ES unit; remote exploitation is not possible under any configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 base score of 2.4 (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately characterizes this as a low-severity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Sony support page at https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-9500es/software/00274922 for a firmware update addressing this authorization bypass; apply any firmware released after 3.02.00 per Sony's guidance, noting that a specific patched version number was not confirmed in the available input data and should be verified directly with Sony before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Xav 9500Es
View allRemote code execution in Sony XAV-9500ES car media receivers is achievable via a classic buffer overflow in the device's
Remote code execution in the Sony XAV-9500ES automotive multimedia head unit is achievable by a network-adjacent attacke
Heap-based buffer overflow in the Sony XAV-9500ES car multimedia receiver's Bluetooth L2CAP SDU reassembly function enab
Command injection in the Sony XAV-9500ES car audio receiver firmware 3.02.00 allows a local attacker with low-privileged
Arbitrary code execution is possible on Sony XAV-9500ES car AV receiver devices through a buffer overflow in the gpsd da
Out-of-bounds read in the prh_l2_decode_packet function of Sony XAV-9500ES car head unit firmware 3.02.0.0 exposes devic
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today