CVE-2025-5476: Sony XAV-AX8500 Auth Bypass Vulnerability

CVE-2025-5476 Overview

CVE-2025-5476 is an authentication bypass vulnerability affecting the Sony XAV-AX8500 in-vehicle receiver. The flaw exists in the Bluetooth stack's handling of Asynchronous Connection-Less User (ACL-U) links and stems from a lack of Logical Link Control and Adaptation Protocol (L2CAP) channel isolation [CWE-653]. A network-adjacent attacker within Bluetooth range can exploit the issue without authentication or user interaction. The vulnerability was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-26284 and tracked publicly as ZDI-25-357.

Critical Impact
An adjacent attacker can bypass Bluetooth authentication on the XAV-AX8500, gaining unauthorized access to paired-device functionality and impacting confidentiality, integrity, and availability of the head unit.

Affected Products

Sony XAV-AX8500 in-vehicle receiver (hardware)
Sony XAV-AX8500 firmware (all versions prior to the vendor's security update)
Bluetooth-enabled configurations using ACL-U links and L2CAP channels

Discovery Timeline

2025-06-21 - CVE-2025-5476 published to the National Vulnerability Database
2026-06-17 - Entry last modified in NVD
Vendor advisory - Sony published a software update for the XAV-AX8500

Technical Details for CVE-2025-5476

Vulnerability Analysis

The vulnerability resides in how the XAV-AX8500 Bluetooth stack implements ACL-U links between the controller and the host. ACL-U links carry asynchronous user-plane traffic and rely on L2CAP to multiplex multiple logical channels over a single physical link. On the affected device, L2CAP channels established over an ACL-U link are not isolated from one another at the security-association boundary. As a result, the authentication state of one channel is implicitly extended to other channels sharing the same link.

An adjacent attacker who establishes a Bluetooth connection can therefore operate on channels that should require successful pairing and link-key authentication. The bypass affects protected profiles exposed by the head unit, with high impact on confidentiality, integrity, and availability of vehicle infotainment functions, paired phone data passing through the unit, and the receiver's runtime state.

Root Cause

The root cause is improper isolation or compartmentalization [CWE-653]. The Bluetooth implementation does not enforce per-channel security checks on L2CAP channels established over an ACL-U link, allowing privileged channels to inherit authentication context from an unauthenticated peer.

Attack Vector

Exploitation requires Bluetooth radio proximity to the target vehicle. The attacker does not need credentials, prior pairing, or user interaction. Once within range, the attacker opens an ACL-U link and issues L2CAP requests targeting channels that should be gated by authentication, then interacts with the protected services as if pairing had succeeded. Technical specifics are documented in the Zero Day Initiative advisory ZDI-25-357.

No public proof-of-concept code has been released. Synthetic exploitation code is not provided here because no verified exploit artifact is available.

Detection Methods for CVE-2025-5476

Indicators of Compromise

Unexpected Bluetooth pairing entries or unknown device names appearing in the XAV-AX8500 paired-device list.
Bluetooth connection events from devices that were never explicitly paired by the vehicle owner.
Unexplained changes to head unit configuration, audio routing, or phonebook contents after parking in public areas.

Detection Strategies

Capture Bluetooth Host Controller Interface (HCI) traces near the vehicle and review L2CAP CONNECT_REQ frames targeting protected Protocol/Service Multiplexers (PSMs) without a preceding successful authentication.
Monitor for repeated ACL-U link establishment attempts from the same Bluetooth Device Address (BD_ADDR) within short time windows.
Audit the head unit's paired-device history during routine vehicle service and flag any entries that the owner cannot account for.

Monitoring Recommendations

Where fleet telematics or mobile device management is available, log Bluetooth pairing events from connected phones and correlate with vehicle location and time.
Track firmware versions across managed fleets and alert on any XAV-AX8500 still running pre-fix firmware.
Treat Bluetooth proximity attacks as part of the vehicle threat model in any organization operating vehicles equipped with this receiver.

How to Mitigate CVE-2025-5476

Immediate Actions Required

Apply the Sony firmware update for the XAV-AX8500 published on the Sony support site.
Until patched, disable Bluetooth on the XAV-AX8500 or set the receiver to non-discoverable mode and avoid initiating new pairings in public areas.
Remove unknown or stale paired devices from the receiver's Bluetooth memory.

Patch Information

Sony has released a software update for the XAV-AX8500 that addresses the L2CAP channel isolation defect. Installation instructions and the firmware image are available from the vendor's XAV-AX8500 software update page. Verify the firmware version after installation to confirm the patched build is active.

Workarounds

Disable Bluetooth on the head unit when not in use and rely on wired connections such as USB or HDMI for media playback.
Limit pairing to controlled environments such as a private garage to reduce the exposure window to nearby attackers.
Re-pair trusted phones after applying the firmware update and clear pre-update pairing records.

bash

# Verification example (run on the XAV-AX8500 settings menu, not a shell)
# 1. Navigate to: Settings > General > System Information
# 2. Confirm firmware version matches the patched build listed on the Sony support page
# 3. Settings > Bluetooth > Paired Devices: remove any unrecognized BD_ADDR entries