6.8

CVE-2024-23922: sony xav-ax5500_firmware

CVSS: 6.8v3.1MediumAnalyzed
Published 23-09-2024Last modified 23-09-2024
Open JSON

Vulnerability summary

CVE-2024-23922 is a medium (CVSS 6.8) vulnerability in sony xav-ax5500_firmware. EPSS estimates a 1.76% chance of exploitation in the next 30 days, higher than 77.6% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
38/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.8/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.76%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database

Timeline

  1. 23-09-2024
    PublishedVulnerability first disclosed.
  2. 23-09-2024
    Last modifiedVulnerability information updated.

Description

Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of software update packages. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-22939

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

1.76%

Chance of exploitation in the next 30 days

Percentile

78%

Versus all other CVEs

30-day change

0.00 pp

From 1.76% on 20-09-2026

20-09-202620-10-2026
EPSS score
1.76%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • exploit-databaseremotemultipleUnverified

    Sony XAV-AX5500 1.13 - Firmware Update Validation Remote Code Execution (RCE)

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Sony1 product

1 vendor · 1 product

References

2 links