ID
VAR-202406-0928
CVE
CVE-2024-23972
TITLE
Sony Corporation's xav-ax5500 Classic buffer overflow vulnerability in firmware
Trust: 0.8
DESCRIPTION
Sony XAV-AX5500 USB Configuration Descriptor Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the USB host driver. A crafted USB configuration descriptor can trigger an overflow of a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23185. Sony Corporation's xav-ax5500 Firmware has a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. SONY XAV-AX5500 is a 7-inch in-vehicle central control device with multiple functions and advanced technical features
Trust: 2.79
IOT TAXONOMY
| category: | ['IoT'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | sony | model: | xav-ax5500 | scope: | - | version: | - | Trust: 1.3 |
| vendor: | sony | model: | xav-ax5500 | scope: | eq | version: | 1.13 | Trust: 1.0 |
| vendor: | ソニー株式会社 | model: | xav-ax5500 | scope: | eq | version: | xav-ax5500 firmware 1.13 | Trust: 0.8 |
| vendor: | ソニー株式会社 | model: | xav-ax5500 | scope: | - | version: | - | Trust: 0.8 |
| vendor: | ソニー株式会社 | model: | xav-ax5500 | scope: | eq | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-120 | Trust: 1.0 |
| problemtype: | Classic buffer overflow (CWE-120) [NVD evaluation ] | Trust: 0.8 |
| problemtype: | Classic buffer overflow (CWE-120) [ others ] | Trust: 0.8 |
PATCH
| title: | Sony has issued an update to correct this vulnerability. | url: | https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-ax5500/software/00274156 | Trust: 0.7 |
| title: | Patch for SONY XAV-AX5500 Buffer Overflow Vulnerability | url: | https://www.cnvd.org.cn/patchInfo/show/703826 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-23972 | Trust: 3.9 |
| db: | ZDI | id: | ZDI-24-876 | Trust: 3.1 |
| db: | JVNDB | id: | JVNDB-2024-009484 | Trust: 0.8 |
| db: | ZDI_CAN | id: | ZDI-CAN-23185 | Trust: 0.7 |
| db: | CNVD | id: | CNVD-2025-14981 | Trust: 0.6 |
REFERENCES
| url: | https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-ax5500/software/00274156 | Trust: 2.5 |
| url: | https://www.zerodayinitiative.com/advisories/zdi-24-876/ | Trust: 2.4 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2024-23972 | Trust: 0.8 |
CREDITS
Synacktiv (@Synacktiv)
Trust: 0.7
SOURCES
| db: | ZDI | id: | ZDI-24-876 |
| db: | CNVD | id: | CNVD-2025-14981 |
| db: | JVNDB | id: | JVNDB-2024-009484 |
| db: | NVD | id: | CVE-2024-23972 |
LAST UPDATE DATE
2025-07-04T23:33:27.901000+00:00
SOURCES UPDATE DATE
| db: | ZDI | id: | ZDI-24-876 | date: | 2024-08-15T00:00:00 |
| db: | CNVD | id: | CNVD-2025-14981 | date: | 2025-07-03T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-009484 | date: | 2024-10-01T04:55:00 |
| db: | NVD | id: | CVE-2024-23972 | date: | 2024-09-30T15:37:30.903 |
SOURCES RELEASE DATE
| db: | ZDI | id: | ZDI-24-876 | date: | 2024-06-21T00:00:00 |
| db: | CNVD | id: | CNVD-2025-14981 | date: | 2025-07-01T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-009484 | date: | 2024-10-01T00:00:00 |
| db: | NVD | id: | CVE-2024-23972 | date: | 2024-09-23T15:15:13.703 |