ZDI-CAN-23319: ZDI-24-878: Sony XAV-AX5500 Insufficient Verification of Data Authenticity Remote Code Execution Vulnerability
Published Jun 21, 2024
·Updated
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2024-23922.
Affected Software
1 affected component
Sony XAV-AX5500
Event History
Jun 21, 2024
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-23319?
ZDI-CAN-23319 has been assigned a CVSS rating of 6.8, indicating a medium severity vulnerability.
2
How do I fix ZDI-CAN-23319?
Mitigation details for ZDI-CAN-23319 are not publicly available; consult your device manufacturer for a fix.
3
Who is affected by ZDI-CAN-23319?
ZDI-CAN-23319 affects installations of Sony XAV-AX5500 devices.
4
Can ZDI-CAN-23319 be exploited remotely?
No, ZDI-CAN-23319 requires physical access to the Sony XAV-AX5500 devices for exploitation.
5
Does ZDI-CAN-23319 require authentication to exploit?
No, ZDI-CAN-23319 does not require authentication for exploitation.