CVE-2026-18283

Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected installations on Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the udev rules. A crafted USB device connected to the system can trigger instantiation of otherwise restricted USB device types. An attacker can leverage this vulnerability to bypass authorization on the system. Was ZDI-CAN-28992.

CVSS v3 2.4 LOW

2.4^/10

CVSS v3 : LOW

Vector : AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability : 0.9 / Impact : 1.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-9500es/software/00274922
https://www.zerodayinitiative.com/advisories/ZDI-26-476/

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de omisión de autorización en las reglas udev USB de Sony XAV-9500ES. Esta vulnerabilidad permite a atacantes con presencia física omitir la autorización en instalaciones afectadas en dispositivos Sony XAV-9500ES. La autenticación no es necesaria para explotar esta vulnerabilidad. La falla específica existe dentro de las reglas udev. Un dispositivo USB manipulado conectado al sistema puede desencadenar la instanciación de tipos de dispositivos USB restringidos de otro modo. Un atacante puede aprovechar esta vulnerabilidad para omitir la autorización en el sistema. Fue ZDI-CAN-28992.

Information

Published : 2026-08-20 17:17

Updated : 2026-10-18 20:10

NVD link : CVE-2026-18283

Mitre link : CVE-2026-18283

CVE.ORG link : CVE-2026-18283

JSON object : View

Products Affected

No product.

CWE

CWE-285

Improper Authorization

{"id": "CVE-2026-18283", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18283", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T19:54:38.494752Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 2.4, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 0.9}]}, "affected": [{"source": "zdi-disclosures@trendmicro.com", "affectedData": [{"vendor": "Sony", "product": "XAV-9500ES", "versions": [{"status": "affected", "version": "3.02.00"}], "defaultStatus": "unknown"}]}], "published": "2026-08-20T17:17:24.763", "references": [{"url": "https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-9500es/software/00274922", "source": "zdi-disclosures@trendmicro.com"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-476/", "source": "zdi-disclosures@trendmicro.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected installations on Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the udev rules. A crafted USB device connected to the system can trigger instantiation of otherwise restricted USB device types. An attacker can leverage this vulnerability to bypass authorization on the system. Was ZDI-CAN-28992."}, {"lang": "es", "value": "Vulnerabilidad de omisi\u00f3n de autorizaci\u00f3n en las reglas udev USB de Sony XAV-9500ES. Esta vulnerabilidad permite a atacantes con presencia f\u00edsica omitir la autorizaci\u00f3n en instalaciones afectadas en dispositivos Sony XAV-9500ES. La autenticaci\u00f3n no es necesaria para explotar esta vulnerabilidad.\n\nLa falla espec\u00edfica existe dentro de las reglas udev. Un dispositivo USB manipulado conectado al sistema puede desencadenar la instanciaci\u00f3n de tipos de dispositivos USB restringidos de otro modo. Un atacante puede aprovechar esta vulnerabilidad para omitir la autorizaci\u00f3n en el sistema. Fue ZDI-CAN-28992."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "zdi-disclosures@trendmicro.com"}