The specific flaw exists within the udev rules. A crafted USB device connected to the system can trigger instantiation of otherwise restricted USB device types. An attacker can leverage this vulnerability to bypass authorization on the system. Was ZDI-CAN-28992.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Sony | XAV-9500ES | unknown |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Thu, 20 Aug 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected installations on Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the udev rules. A crafted USB device connected to the system can trigger instantiation of otherwise restricted USB device types. An attacker can leverage this vulnerability to bypass authorization on the system. Was ZDI-CAN-28992. | |
| Title | Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability | |
| Weaknesses | CWE-285 | |
| References |
| |
| Metrics |
cvssV3_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: zdi
Published:
Updated: 2026-08-20T16:19:39.821Z
Reserved: 2026-07-29T17:06:05.969Z
Link: CVE-2026-18283
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-20T17:17:24.763
Modified: 2026-08-20T17:17:24.763
Link: CVE-2026-18283
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-20T20:00:05Z