CVE-2025-5475: Sony XAV-AX8500 Firmware RCE Vulnerability

CVE-2025-5475 Overview

CVE-2025-5475 is an integer overflow vulnerability [CWE-190] in the Sony XAV-AX8500 in-vehicle receiver. The flaw resides in the device's Bluetooth packet handling logic and enables network-adjacent attackers to execute arbitrary code on affected units. Exploitation requires the attacker to first pair a malicious Bluetooth device with the target system. Successful exploitation results in code execution in the context of the elysian-bt-service process. The Zero Day Initiative tracked this issue as ZDI-CAN-26283 and published advisory ZDI-25-353.

Critical Impact
Attackers within Bluetooth range who can pair a malicious device can execute arbitrary code within the elysian-bt-service process, compromising the integrity of the in-vehicle infotainment system.

Affected Products

Sony XAV-AX8500 (hardware)
Sony XAV-AX8500 firmware (all versions prior to the vendor fix)
Sony XAV series in-vehicle receivers using the elysian-bt-service Bluetooth stack

Discovery Timeline

2025-06-21 - CVE-2025-5475 published to NVD
2025-07-08 - Last updated in NVD database

Technical Details for CVE-2025-5475

Vulnerability Analysis

The vulnerability exists in the Bluetooth packet processing code path of the Sony XAV-AX8500 firmware. The elysian-bt-service process accepts data from paired Bluetooth peers and fails to properly validate user-supplied size or length fields. The unchecked value participates in an arithmetic operation that wraps around the integer boundary, producing a smaller-than-expected allocation or copy length. Subsequent memory write operations then exceed the intended buffer, corrupting adjacent memory.

An attacker who controls the wrapped value can shape the out-of-bounds write to overwrite control structures. This grants arbitrary code execution in the context of the elysian-bt-service process, which handles Bluetooth profiles on the receiver. The attack is adjacent-network: the adversary must be within Bluetooth range and complete the pairing step before sending the malformed packets.

Root Cause

The root cause is missing validation of attacker-controlled length or count fields supplied through a Bluetooth packet. The firmware performs arithmetic on these fields, such as multiplication or addition with a header constant, without checking for integer wrap. The truncated result is then used to size a memory write, producing a heap or stack overflow downstream.

Attack Vector

Exploitation requires Bluetooth-adjacent positioning and the ability to pair with the target receiver. After pairing, the attacker transmits crafted Bluetooth packets containing length fields engineered to trigger the overflow. No user interaction beyond the pairing step is required, and no authentication credentials are needed once pairing succeeds. Refer to the ZDI Security Advisory #25-353 for additional technical detail.

Detection Methods for CVE-2025-5475

Indicators of Compromise

Unexpected Bluetooth pairing requests or successful pairings with unknown devices on the XAV-AX8500 receiver
Crashes, reboots, or service restarts involving the elysian-bt-service process recorded in vendor diagnostic logs
Anomalous Bluetooth traffic patterns containing oversized or malformed length fields targeting paired services

Detection Strategies

Audit the receiver's paired-device list and remove unknown or unauthorized entries
Monitor for repeated pairing attempts in proximity to the vehicle, which may indicate reconnaissance against the Bluetooth attack surface
Compare installed firmware versions against the fixed build published in the Sony Software Update advisory

Monitoring Recommendations

Track firmware version inventory across fleets of vehicles that use the XAV-AX8500
Educate drivers to report unexpected pairing prompts or persistent infotainment crashes
Where fleet telemetry is available, alert on repeated elysian-bt-service restarts as a possible exploitation indicator

How to Mitigate CVE-2025-5475

Immediate Actions Required

Install the firmware update referenced in the Sony Software Update advisory for the XAV-AX8500
Remove all unknown or unused Bluetooth pairings from the receiver
Disable Bluetooth on the receiver when not in active use until the firmware update has been applied

Patch Information

Sony has published a firmware update for the XAV-AX8500 that addresses CVE-2025-5475. The update is available through the Sony Software Update page. Apply the update following the vendor's documented USB-based update procedure to remediate the integer overflow in the Bluetooth packet handler.

Workarounds

Disable Bluetooth on the XAV-AX8500 until the firmware update is applied
Reject pairing requests from unknown devices and clear the paired-device list periodically
Park the vehicle in environments that limit Bluetooth-range exposure to untrusted parties when feasible

bash

# Vendor update procedure (high-level)
# 1. Download the firmware update from the Sony support page
# 2. Copy the firmware file to the root of a FAT32-formatted USB drive
# 3. Insert the USB drive into the XAV-AX8500 USB port
# 4. Follow the on-screen prompts to apply the update
# 5. After reboot, verify the installed firmware version matches the fixed release