CVE-2025-5476CWE-653

Sony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass Vulnerability

Medium · published June 21, 2025

CVSS v3.0
6.3
EPSS
0%
Percentile
29.0
In the wild
Unconfirmed
What it is

Sony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected Sony XAV-AX8500 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of ACL-U links. The issue results from the lack of L2CAP channel isolation. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26284.

The record
Technical detail
CVSS v3.0
6.3 · MEDIUM
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00364 · 29.0th percentile
Weakness
CWE-653 · Improper Isolation or Compartmentalization
Published
2025-06-21T00:09Z
EPSS history
Timeline
  • 21 JUN 00:09Z
    Sony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass Vulnerability
    cvelistv5