CVE-2025-5820
High
Description
Sony XAV-AX8500 Bluetooth ERTM Channel Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected Sony XAV-AX8500 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of Bluetooth ERTM channel communication. The issue results from improper channel data initialization. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26285.
SeverityHigh
CVSS8.8
Exploit probability—
ProductSony Xav-ax8500 Firmware
PublishedJun 21, 2025
First seenJun 21, 2025
Weakness typeCWE-288CWE-288
How to fix
Update
- sony xav-ax8500_firmware3.02.00 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sony xav-ax8500_firmware | 2.00.1 ≤ v < 3.02.00 | 3.02.00 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.