Xav Ax8500 Firmware EUVD-2025-18880

This vulnerability presents genuine and significant risk despite requiring network-adjacent attack vector (AV:A). The CVSS 3.1 vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H demonstrates: (1) low attack complexity (AC:L) meaning no special conditions or tools required beyond proximity; (2) no privileges required (PR:N) and no user interaction needed (UI:N); (3) complete confidentiality, integrity, and availability impact (C:H/I:H/A:H). The authentication bypass nature combined with 'network-adjacent' classification suggests attackers within Bluetooth range (~10-100 meters depending on power class) can fully compromise the device. This is particularly concerning for automotive infotainment systems where physical proximity to vehicles in parking lots or traffic is readily achievable. Without KEV/EPSS data explicitly provided, the low attack complexity, lack of required interaction, and complete impact scope suggest exploitation probability is moderate-to-high. The logical nature of the flaw (authentication bypass via channel initialization) rather than requiring sophisticated reverse engineering suggests working exploits are plausible and potentially already in the wild given this is a 2025 CVE.

An attacker parks near a vehicle equipped with a Sony XAV-AX8500 receiver within Bluetooth range (approximately 10-100 meters depending on power class). Using a standard Bluetooth adapter and custom software, the attacker initiates a connection and exploits the improper ERTM channel initialization by sending specially crafted L2CAP channel setup packets that bypass the normal authentication sequence. Because the vulnerability exists in channel data initialization and the AC:L (low complexity) rating indicates no special conditions required, the attacker can establish an authenticated-equivalent session without completing Bluetooth pairing or providing credentials. Once bypass is achieved, the attacker gains full access to infotainment system functions including media playback, navigation data, hands-free calling records, contact lists, and potentially vehicle control interfaces if integrated with the infotainment system. The attack requires no user interaction (UI:N) - the vehicle owner need not accept any pairing prompts or confirmations. No publicly disclosed POC is referenced in the provided data, but the low-complexity, logical nature of the flaw (authentication bypass rather than cryptographic break) suggests functional exploits could be rapidly developed or may already exist.