Back

CVE-2024-23922

Sept. 23, 2024, 3:15 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Sony XAV-AX5500

Source

cve@asrg.io

Tags

CWE-345
cve@asrg.io
2024-09-23
CVE-2024-23922

CVE-2024-23922 details

Published : Sept. 23, 2024, 3:15 p.m.
Last Modified : Sept. 23, 2024, 3:15 p.m.

Description

Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of software update packages. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-22939

CVSS Score

1 2 3 4 5 6.8 7 8 9 10

Weakness

Weakness Name Description
CWE-345 Insufficient Verification of Data Authenticity The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

CVSS Data

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

6.8

Exploitability Score

0.9

Impact Score

5.9

Base Severity

MEDIUM

Vector String : CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL Source
https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-ax5500/software/00274156 cve@asrg.io
https://www.zerodayinitiative.com/advisories/ZDI-24-874/ cve@asrg.io
This website uses the NVD API, but is not approved or certified by it.