CVE-2026-18283
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability in Sony XAV-9500ES devices allows physically present attackers to bypass authorization by connecting a crafted USB device. The flaw exists in the udev rules, which can trigger instantiation of restricted USB device types. Authentication is not required to exploit this vulnerability.
Risk Assessment
An attacker with physical access can bypass authorization mechanisms, potentially leading to unauthorized access to system functions.
Recommendation
Restrict physical access to the device and monitor connected USB devices. Follow manufacturer updates and apply patches if available.
Other vulnerabilities in Sony XAV-9500ES
See all- CVE-2026-18284High
Vulnerability in Sony XAV-9500ES device in crash dump handling allows local privilege escalation via command injection. Lack of string validation before using it in a system call. Requires low-privileged access to the system.
- CVE-2026-18282High
Vulnerability in Sony XAV-9500ES device in AVRCP_Br_Response_Parser allows remote code execution via heap-based buffer overflow. Lack of length validation before copying data to a buffer. Requires pairing a malicious Bluetooth device.
- CVE-2026-18281High
Vulnerability in Sony XAV-9500ES device in l2_reassemble_sdu allows remote code execution via heap-based buffer overflow. Lack of length validation before copying data to a buffer. Requires pairing a malicious Bluetooth device.
- CVE-2026-18280Low
A vulnerability in Sony XAV-9500ES devices allows physically present attackers to execute arbitrary code in the context of the gpsd daemon. The flaw is due to improper validation of NMEA data length before copying to a fixed-length buffer, leading to a buffer overflow. Authentication is not required.
- CVE-2026-18279High
Vulnerability in Sony XAV-9500ES device in handling of RTSP SETUP packets allows remote code execution via buffer overflow. Lack of length validation before copying data to a fixed-length buffer. Authentication is not required.
- CVE-2026-18278Low
A vulnerability in Sony XAV-9500ES devices allows network-adjacent attackers to disclose sensitive information via an out-of-bounds read when handling Bluetooth L2CAP packets. The attacker must first pair a malicious Bluetooth device with the target system.
Original NVD description (English source)
Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected installations on Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the udev rules. A crafted USB device connected to the system can trigger instantiation of otherwise restricted USB device types. An attacker can leverage this vulnerability to bypass authorization on the system. Was ZDI-CAN-28992.