CVE-2026-18283
Received Received - Intake

Sony XAV-9500ES udev USB Rules Authorization Bypass

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: Zero Day Initiative

Description
Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected installations on Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the udev rules. A crafted USB device connected to the system can trigger instantiation of otherwise restricted USB device types. An attacker can leverage this vulnerability to bypass authorization on the system. Was ZDI-CAN-28992.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-18283
EUVD
EUVD-2026-63430

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sony xav-9500es *
sony xav-9500es to 2026-07-29 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authorization bypass vulnerability in the Sony XAV-9500ES device. It allows physically present attackers to bypass authentication by connecting a specially crafted USB device. The flaw exists in the udev rules, which can be tricked into enabling restricted USB device types, granting unauthorized access.

Detection Guidance

This vulnerability requires physical access to the Sony XAV-9500ES device. Detection involves monitoring for unauthorized USB device connections that trigger restricted device types. Check udev logs for unusual USB device instantiation events using commands like 'udevadm monitor' or 'journalctl -u systemd-udevd'.

Impact Analysis

An attacker with physical access could exploit this to bypass security controls on the Sony XAV-9500ES device. This may allow unauthorized actions like accessing restricted features or data, though it does not directly impact confidentiality or availability.

Compliance Impact

This vulnerability allows unauthorized physical access via USB devices, which could potentially lead to unauthorized modifications or data access on the system. However, the low CVSS score (2.4) and limited impact on confidentiality or availability suggest minimal direct compliance risks under standards like GDPR or HIPAA.

Mitigation Strategies

Apply the official update from Sony to fix the udev rules. Ensure physical access to the device is restricted to authorized personnel only. Monitor USB connections and disable automatic USB device handling if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18283. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart