VulnerabilityDeferred

CVE-2026-18283

Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability.

LOW 2.4EPSS 0.23%

Does this matter?

Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.

Description

Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected installations on Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the udev rules. A crafted USB device connected to the system can trigger instantiation of otherwise restricted USB device types. An attacker can leverage this vulnerability to bypass authorization on the system. Was ZDI-CAN-28992.

CVSS 3.0: 2.4 LOWCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.23% probability · 13th percentile
CISA KEV: Not listed
Weakness: CWE-285
Source: zdi-disclosures@trendmicro.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.