CVE-2025-5477: Sony XAV-AX8500 Firmware RCE Vulnerability

CVE-2025-5477 Overview

CVE-2025-5477 is a heap-based buffer overflow [CWE-122] in the Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) implementation of the Sony XAV-AX8500 in-vehicle receiver. The flaw enables network-adjacent attackers to execute arbitrary code in the context of the elysian-bt-service process. Exploitation requires the attacker to first pair a malicious Bluetooth device with the target system. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-26286 and disclosed in advisory ZDI-25-354.

Critical Impact
Successful exploitation grants remote code execution on the head unit through the elysian-bt-service process, compromising the integrity, confidentiality, and availability of the affected device.

Affected Products

Sony XAV-AX8500 hardware (in-vehicle media receiver)
Sony XAV-AX8500 firmware (all versions prior to the vendor fix referenced in update 00344092)
Bluetooth L2CAP service component (elysian-bt-service)

Discovery Timeline

2025-06-21 - CVE-2025-5477 published to the National Vulnerability Database
2025-07-08 - Last updated in NVD database
Vendor advisory and software update published by Sony for the XAV-AX8500 product line
Coordinated disclosure handled through the Zero Day Initiative Advisory ZDI-25-354

Technical Details for CVE-2025-5477

Vulnerability Analysis

The flaw resides in how the XAV-AX8500 parses Bluetooth L2CAP traffic during a paired session. The elysian-bt-service process accepts attacker-supplied data over an L2CAP channel and copies it into a fixed-size heap buffer without first validating the length field. Because the bounds check is missing, an attacker can supply a payload larger than the destination allocation and corrupt adjacent heap metadata or function pointers.

The attacker must hold an active Bluetooth pairing with the target, which constrains the attack to adjacent-network range. Once paired, however, no further user interaction is required to trigger the overflow. Code that runs in the elysian-bt-service context inherits that service's permissions on the head unit, providing a foothold into the in-vehicle infotainment stack.

Root Cause

The root cause is improper validation of the length of user-supplied data prior to a heap copy operation, classified as [CWE-122] Heap-based Buffer Overflow. The L2CAP packet handler trusts a length value derived from attacker-controlled input and uses it to drive a memory copy into a smaller destination buffer.

Attack Vector

Exploitation proceeds in three stages. First, the attacker pairs a malicious Bluetooth device with the XAV-AX8500. Second, the attacker establishes an L2CAP channel to the vulnerable service. Third, the attacker transmits a crafted L2CAP protocol data unit whose declared or implicit length exceeds the destination heap buffer, overwriting adjacent heap structures. Reliable code execution requires shaping the heap and corrupting a control structure consumed by elysian-bt-service.

No public proof-of-concept exploit code is available at the time of this writing. Technical details are documented in the Zero Day Initiative Advisory ZDI-25-354.

Detection Methods for CVE-2025-5477

Indicators of Compromise

Unexpected Bluetooth pairing requests or paired-device entries on the XAV-AX8500 that the vehicle owner did not initiate.
Crashes, reboots, or audio service interruptions on the head unit shortly after a Bluetooth connection from an unknown device.
Malformed or oversized L2CAP packets observed on Bluetooth captures targeting the receiver.

Detection Strategies

Capture Bluetooth Host Controller Interface (HCI) traffic in test environments and inspect L2CAP frames for length fields that exceed protocol-defined bounds.
Monitor for repeated pairing attempts from unfamiliar device addresses in proximity to the vehicle.
Track firmware version state across fleet or dealer-managed vehicles to identify units that remain on vulnerable builds.

Monitoring Recommendations

Audit paired Bluetooth devices on the head unit periodically and remove any unrecognized entries.
Where vehicle telematics permit, log Bluetooth service restarts and abnormal terminations of elysian-bt-service.
For research and red-team environments, instrument L2CAP fuzzing harnesses to detect heap corruption patterns consistent with this class of flaw.

How to Mitigate CVE-2025-5477

Immediate Actions Required

Apply the Sony firmware update referenced in Sony Software Update 00344092 to all affected XAV-AX8500 units.
Remove unknown or unused paired Bluetooth devices from the head unit immediately.
Avoid pairing with untrusted Bluetooth devices, especially in shared parking environments, until the patch is installed.

Patch Information

Sony has published a firmware update for the XAV-AX8500 that addresses CVE-2025-5477. The update is distributed through the official product support page and must be applied per the vendor instructions, typically via USB flash media. Refer to the Sony XAV-AX8500 Software Update for the current firmware package and installation guide.

Workarounds

Disable the Bluetooth radio on the XAV-AX8500 when not in active use to remove the attack surface.
Do not place the unit into pairing mode in public or untrusted locations until patched.
Limit physical and proximity access to the vehicle to reduce opportunity for an attacker to initiate a pairing dialog.

bash

# No vendor-provided command-line mitigation exists for the XAV-AX8500.
# Mitigation is performed through the head unit menu:
#   Settings -> Bluetooth -> Connection -> Off
#   Settings -> General -> System Information -> Update (apply firmware 00344092)