ZDI-CAN-22939: ZDI-24-874: (Pwn2Own) Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of software update packages. An attacker can leverage this vulnerability to execute code in the context of the device.
Other sources
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2024-23922.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-22939?
The severity of ZDI-CAN-22939 is critical due to the potential for arbitrary code execution.
How can I mitigate ZDI-CAN-22939?
To mitigate ZDI-CAN-22939, ensure that your Sony XAV-AX5500 device is updated with the latest firmware provided by the manufacturer.
Who is affected by ZDI-CAN-22939?
ZDI-CAN-22939 affects all installations of Sony XAV-AX5500 devices.
Is authentication required to exploit ZDI-CAN-22939?
No, authentication is not required to exploit ZDI-CAN-22939, making it particularly dangerous.
What kind of attack does ZDI-CAN-22939 allow?
ZDI-CAN-22939 allows physically present attackers to execute arbitrary code on vulnerable devices.