What is the severity of ZDI-CAN-22994?

The severity of ZDI-CAN-22994 is considered critical due to its potential for remote code execution.

How do I fix ZDI-CAN-22994?

To fix ZDI-CAN-22994, users should ensure their Sony XAV-AX5500 devices are updated to the latest firmware provided by Sony.

Who is affected by ZDI-CAN-22994?

ZDI-CAN-22994 affects users of Sony XAV-AX5500 devices.

What type of attacker exploits ZDI-CAN-22994?

Remote attackers with access to malicious links or files can exploit ZDI-CAN-22994.

Does ZDI-CAN-22994 require user interaction to exploit?

Yes, ZDI-CAN-22994 requires user interaction, as the target must visit a malicious page or open a malicious file.

Vulnerability/
ZDI-CAN-22994

high

8.8

21/6/2024

23/9/2024

ZDI-CAN-22994: ZDI-24-875: (Pwn2Own) Sony XAV-AX5500 WMV/ASF Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

First published: Fri Jun 21 2024(Updated: )

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WMV/ASF files. A crafted Extended Content Description Object in a WMV media file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device.

Affected Software	Affected Version	How to fix
Sony XAV-AX5500

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of ZDI-CAN-22994?
The severity of ZDI-CAN-22994 is considered critical due to its potential for remote code execution.
How do I fix ZDI-CAN-22994?
To fix ZDI-CAN-22994, users should ensure their Sony XAV-AX5500 devices are updated to the latest firmware provided by Sony.
Who is affected by ZDI-CAN-22994?
ZDI-CAN-22994 affects users of Sony XAV-AX5500 devices.
What type of attacker exploits ZDI-CAN-22994?
Remote attackers with access to malicious links or files can exploit ZDI-CAN-22994.
Does ZDI-CAN-22994 require user interaction to exploit?
Yes, ZDI-CAN-22994 requires user interaction, as the target must visit a malicious page or open a malicious file.

collector/zdi-published
source/ZDI
alias/ZDI-CAN-22994
agent/last-modified-date
agent/title
agent/type
agent/first-publish-date
agent/references
agent/severity
agent/description
collector/zdi-advisory
alias/ZDI-24-875
alias/CVE-2024-23934
agent/software-canonical-lookup
agent/software-canonical-lookup-request
agent/softwarecombine
agent/event
agent/trending
agent/tags
agent/source
vendor/sony
canonical/sony xav-ax5500

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of ZDI-CAN-22994?
The severity of ZDI-CAN-22994 is considered critical due to its potential for remote code execution.
How do I fix ZDI-CAN-22994?
To fix ZDI-CAN-22994, users should ensure their Sony XAV-AX5500 devices are updated to the latest firmware provided by Sony.
Who is affected by ZDI-CAN-22994?
ZDI-CAN-22994 affects users of Sony XAV-AX5500 devices.
What type of attacker exploits ZDI-CAN-22994?
Remote attackers with access to malicious links or files can exploit ZDI-CAN-22994.
Does ZDI-CAN-22994 require user interaction to exploit?
Yes, ZDI-CAN-22994 requires user interaction, as the target must visit a malicious page or open a malicious file.