Skip to content
OpenAdvisories
Medium · 6.8 Public exploit CVE-2024-23922 EUVD-2024-21352GHSA-rcch-4525-rq2f

Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability

Published Sep 23, 2024 · Updated Sep 23, 2024 · Assigned by ASRG

Vendor: Sony Product: XAV-AX5500

Description

Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of software update packages. An attacker can leverage this vulnerability to execute code in the context of the device.

Was ZDI-CAN-22939

Affected products

VendorProductAffectedFixed
Sony XAV-AX5500 1.13 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References