EUVD-2026-63431
GHSA-3j3v-5mxm-2c69
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector and low-privilege prerequisite confirmed by description; no scope change; full C/I/A impact reflects root-level code execution on the device.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
Sony XAV-9500ES Crash Dump Handler Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of process crash dumps. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-29061.
AnalysisAI
Command injection in the Sony XAV-9500ES car audio receiver firmware 3.02.00 allows a local attacker with low-privileged code execution to escalate to root via the device's crash dump handler. The handler passes user-controlled input directly to an OS system call without sanitization (CWE-78), enabling arbitrary command execution at the highest privilege level. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation unconditionally requires that the attacker first obtain low-privileged code execution on the XAV-9500ES device - this prerequisite is explicitly stated in the CVE description and is reflected in the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes this as a high-severity local privilege escalation: low complexity, no user interaction, and full confidentiality, integrity, and availability impact on the device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the firmware update published by Sony at the official XAV-9500ES support page: https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-9500es/software/00274922. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your environment to identify all Sony XAV-9500ES units running firmware version 3.02.00 and document their network connectivity status and integration points with enterprise or vehicle systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Xav 9500Es
View allRemote code execution in Sony XAV-9500ES car media receivers is achievable via a classic buffer overflow in the device's
Remote code execution in the Sony XAV-9500ES automotive multimedia head unit is achievable by a network-adjacent attacke
Heap-based buffer overflow in the Sony XAV-9500ES car multimedia receiver's Bluetooth L2CAP SDU reassembly function enab
Arbitrary code execution is possible on Sony XAV-9500ES car AV receiver devices through a buffer overflow in the gpsd da
Out-of-bounds read in the prh_l2_decode_packet function of Sony XAV-9500ES car head unit firmware 3.02.0.0 exposes devic
Authorization bypass in the Sony XAV-9500ES in-car media receiver allows a physically present attacker to connect a craf
Same weakness CWE-78 – OS Command Injection
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today