Sony XAV-9500ES EUVD-2026-63430

Exploitation unconditionally requires the attacker to be physically present and able to connect a USB device to the XAV-9500ES unit; remote exploitation is not possible under any configuration. The triggering condition is a crafted USB device whose descriptors (vendor ID, product ID, device class, or interface class) satisfy the flawed udev rule matching logic so as to instantiate an otherwise restricted USB device type. No prior authentication, credentials, or account access are required (PR:N per CVSS). Limiting factors: physical presence is mandatory and non-bypassable; the impact is integrity-only at low severity with no data exfiltration capability; and the target is a consumer car audio receiver, which significantly narrows the realistic threat actor population and opportunity window.

The CVSS 3.0 base score of 2.4 (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately characterizes this as a low-severity issue. The physical access vector (AV:P) is the dominant risk limiter - remote and network-based exploitation is entirely excluded, and the attacker must have hands-on access to the vehicle's USB port. There is no CVSS scope change (S:U), no confidentiality impact (C:N), and no availability impact (A:N), leaving only a low integrity impact. No EPSS score was provided in the source data; given the physical-only vector and niche consumer electronics context, real-world exploitation at scale is implausible. No CISA KEV listing and no public POC code were identified. The practical threat model is limited to a vehicle thief, insider, or valet with brief unsupervised physical access seeking to enable a blocked USB device class on the head unit. The low CVSS score and physical requirement together indicate this is not a priority for most security programs unless the vehicle fleet operates in a high-security context.

An attacker with brief physical access to the vehicle - such as a valet, mechanic, or opportunistic thief - plugs a purpose-built USB device with crafted descriptor fields into the XAV-9500ES USB port; the device's vendor ID, product ID, or interface class values satisfy the flawed udev rule matching logic in a way that causes the kernel to instantiate a restricted device type normally blocked by the unit's authorization policy. With the unauthorized device type active, the attacker gains interaction capabilities with the head unit's interfaces - for example, HID input or storage access - beyond what is intended by the manufacturer. No public proof-of-concept code has been identified, though the low attack complexity (AC:L) suggests the crafted descriptor approach is technically straightforward for a motivated researcher.