ZDI-24-874: (Pwn2Own) Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of software update packages. An attacker can leverage this vulnerability to execute code in the context of the device.
Other sources
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2024-23922.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-874?
The severity of ZDI-24-874 is critical due to the potential for arbitrary code execution by an unauthenticated attacker.
How do I fix ZDI-24-874?
To fix ZDI-24-874, ensure that you have the latest firmware update installed for your Sony XAV-AX5500 device.
Who is affected by ZDI-24-874?
ZDI-24-874 affects all installations of Sony XAV-AX5500 devices that have not applied the necessary security updates.
What type of attacker can exploit ZDI-24-874?
Physically present attackers can exploit ZDI-24-874 without requiring authentication.
What is the impact of ZDI-24-874?
The impact of ZDI-24-874 allows attackers to execute arbitrary code on vulnerable devices, potentially compromising user data and device functionality.