What’s Vulnerable › Vulnerabilities

CVE-2026-18283: Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability

• Severity: low (CVSS 2.4 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-20 · updated 2026-10-18
• Weakness: CWE-285

Description

Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected installations on Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the udev rules. A crafted USB device connected to the system can trigger instantiation of otherwise restricted USB device types. An attacker can leverage this vulnerability to bypass authorization on the system. Was ZDI-CAN-28992.

Affected products

• Sony XAV-9500ES: 3.02.00

References

• https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-9500es/software/00274922
• https://www.zerodayinitiative.com/advisories/ZDI-26-476/

Get alerted when CVE-2026-18283 or the next vulnerability affects your stack