CVE-2018-16593

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-19 · updated 2026-06-17
Weakness: CWE-78

Description

The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Shell Metacharacter Injection.

Affected products

Sony R5C Firmware: before 8.590 — fixed in 8.590
Sony Wd65 Firmware: before 8.216 — fixed in 8.216
Sony Wd75 Firmware: before 8.216 — fixed in 8.216
Sony We6 Firmware: before 8.464 — fixed in 8.464
Sony We75 Firmware: before 8.464 — fixed in 8.464
Sony Wf6 Firmware: before 8.464 — fixed in 8.464
Sony Xe70 Firmware: before 8.764 — fixed in 8.764
Sony Xf70 Firmware: before 8.764 — fixed in 8.764

How to fix

Upgrade to a fixed version: Sony R5C Firmware 8.590; Sony Wd65 Firmware 8.216; Sony Wd75 Firmware 8.216; Sony We6 Firmware 8.464; Sony We75 Firmware 8.464; Sony Wf6 Firmware 8.464; Sony Xe70 Firmware 8.764; Sony Xf70 Firmware 8.764. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-16593 or the next vulnerability affects your stack