Command Injection Vulnerability in Sony XAV-9500ES Device

CVE-2026-18284

What is CVE-2026-18284?

A command injection vulnerability exists in the crash dump handling of the Sony XAV-9500ES. This flaw allows local attackers with low-privileged access to escalate their privileges, enabling them to execute arbitrary code as the root user. The issue arises from improper validation of user-supplied strings used in system calls. To exploit this vulnerability, an attacker must first gain the ability to run low-privileged code on the device. For more information, refer to the advisory provided by Zero Day Initiative.

References