{"id":"CVE-2026-18283","aliases":["EUVD-2026-63430","GHSA-j2pg-r74g-f5v5"],"status":"published","title":"Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability","description":"Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected installations on Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the udev rules. A crafted USB device connected to the system can trigger instantiation of otherwise restricted USB device types. An attacker can leverage this vulnerability to bypass authorization on the system. Was ZDI-CAN-28992.","severity":{"version":"3.0","score":2.4,"vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0027,"percentile":0.19406,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-285"],"published":"2026-08-20T16:19:39Z","modified":"2026-10-18T20:10:00Z","products":[{"vendor":"sony","product":"xav-9500es"}],"references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-476/","tags":["x_research-advisory"]},{"url":"https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-9500es/software/00274922","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18283"},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-476"},{"url":"https://github.com/advisories/GHSA-j2pg-r74g-f5v5"}],"sources":{"cve":[{"id":"CVE-2026-18283","title":"Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability","description":"Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected installations on Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the udev rules. A crafted USB device connected to the system can trigger instantiation of otherwise restricted USB device types. An attacker can leverage this vulnerability to bypass authorization on the system. Was ZDI-CAN-28992.","status":"published","published":"2026-08-20T16:19:39.821Z","modified":"2026-08-21T20:08:41.154Z","cvss":[{"version":"3.0","score":2.4,"vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:20:12.60856Z"}],"euvd":[{"id":"EUVD-2026-63430","description":"Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected installations on Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the udev rules. A crafted USB device connected to the system can trigger instantiation of otherwise restricted USB device types. An attacker can leverage this vulnerability to bypass authorization on the system. Was ZDI-CAN-28992.","status":"published","published":"2026-08-20T16:19:39Z","modified":"2026-08-21T20:08:41Z","cvss":[{"version":"3.0","score":2.4,"vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T18:01:36.844009Z"}],"ghsa":[{"id":"GHSA-j2pg-r74g-f5v5","title":"Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows...","description":"Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected installations on Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the udev rules. A crafted USB device connected to the system can trigger instantiation of otherwise restricted USB device types. An attacker can leverage this vulnerability to bypass authorization on the system. Was ZDI-CAN-28992.","status":"published","published":"2026-08-20T18:30:56Z","modified":"2026-08-20T18:31:06Z","cvss":[{"version":"3.0","score":2.4,"vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:10:47.706589Z"}],"nvd":[{"id":"CVE-2026-18283","description":"Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected installations on Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the udev rules. A crafted USB device connected to the system can trigger instantiation of otherwise restricted USB device types. An attacker can leverage this vulnerability to bypass authorization on the system. Was ZDI-CAN-28992.","status":"published","published":"2026-08-20T17:17:24.763Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.0","score":2.4,"vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:12:40.302911Z"}]}}