CVE-2024-23922 MEDIUM

CVE-2024-23922: Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability

Vendor Sony
Product XAV-AX5500
Weakness CWE-345
Published September 23, 2024
Last update September 23, 2024
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Physical
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of software update packages. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-22939

Key dates

02Disclosure timeline

September 23, 2024 CVE published
September 23, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-44999 OpenClaw < 2026.4.20 - Improper Trust Labeling in Isolated Cron Awareness Events CVE-2026-48096 OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning CVE-2024-3049 Booth: specially crafted hash can lead to invalid hmac being accepted by booth server CVE-2026-24775 OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension CVE-2023-52109