CVE-2024-23972: medium-severity vulnerability in Sony XAV-AX5500
Sony XAV-AX5500 USB Configuration Descriptor Buffer Overflow Remote Code Execution Vulnerability
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A Sony XAV-AX5500 car audio system can be hacked through a specially crafted USB device that overflows its memory buffer. An attacker with physical access to a USB port can run harmful code on the device without needing a password.
A buffer overflow vulnerability exists in the USB host driver of Sony XAV-AX5500 devices when processing malformed USB configuration descriptors. An attacker with physical access can supply a crafted USB device to trigger the overflow and achieve arbitrary code execution in the device context without authentication.
In the same product, most dangerous first.