CVE-2025-5820: Sony XAV-AX8500 Auth Bypass Vulnerability

CVE-2025-5820 Overview

CVE-2025-5820 is an authentication bypass vulnerability affecting the Sony XAV-AX8500 in-vehicle receiver. The flaw resides in the implementation of Bluetooth Enhanced Retransmission Mode (ERTM) channel communication. Improper channel data initialization allows network-adjacent attackers to bypass authentication on affected devices without any user interaction or prior credentials. The issue is tracked under CWE-288: Authentication Bypass Using an Alternate Path or Channel and was reported through the Zero Day Initiative as ZDI-CAN-26285.

Critical Impact
An attacker within Bluetooth range can bypass pairing authentication on the Sony XAV-AX8500 and gain unauthorized access to the device, impacting confidentiality, integrity, and availability.

Affected Products

Sony XAV-AX8500 (hardware)
Sony XAV-AX8500 Firmware
In-vehicle infotainment receivers using the vulnerable Bluetooth ERTM implementation

Discovery Timeline

2025-06-21 - CVE-2025-5820 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5820

Vulnerability Analysis

The vulnerability exists in the Bluetooth ERTM channel handler of the Sony XAV-AX8500 in-vehicle receiver. ERTM is an L2CAP transport mode that provides reliable, ordered delivery of data over Bluetooth BR/EDR connections. The Sony implementation fails to properly initialize channel state data when establishing an ERTM channel.

Because the channel data is not correctly initialized, the device treats the inbound L2CAP channel as if it has already completed authentication. An attacker within Bluetooth range can therefore interact with services that should require successful pairing, including profiles such as Hands-Free, A2DP, and Phone Book Access.

Exploitation does not require user interaction, valid credentials, or a previously paired device. The attacker only needs to be on the adjacent network — that is, within radio range of the target receiver.

Root Cause

The root cause is improper channel data initialization within the ERTM channel setup routine. Authentication state for the L2CAP channel is left in a default or stale condition rather than being explicitly enforced as unauthenticated until pairing completes. This maps to CWE-288, where an alternate code path skips the intended authentication check.

Attack Vector

The attack requires Bluetooth proximity to the targeted vehicle or device. An attacker uses a Bluetooth-capable host to initiate an L2CAP connection using ERTM against the Sony XAV-AX8500. By driving the channel through the uninitialized state path, the attacker reaches authenticated services without completing pairing. From that position, the attacker can interact with exposed Bluetooth profiles, retrieve data, or manipulate the receiver.

No verified public proof-of-concept exploit code is available. Technical details are documented in the Zero Day Initiative Advisory ZDI-25-358.

Detection Methods for CVE-2025-5820

Indicators of Compromise

Unexpected Bluetooth pairings or connections to the XAV-AX8500 from unknown device addresses appearing in the receiver's paired device list.
L2CAP ERTM channel establishment events from non-paired peers observed during Bluetooth packet captures near the vehicle.
Anomalous access to Bluetooth profiles such as PBAP, HFP, or A2DP without a corresponding pairing confirmation on the head unit.

Detection Strategies

Capture Bluetooth HCI traffic in controlled environments using tools such as btmon or Ubertooth to identify L2CAP configuration requests that proceed to data exchange without an authentication complete event.
Inspect the XAV-AX8500 paired device list during scheduled vehicle maintenance to identify entries that owners do not recognize.
Correlate physical presence of unknown Bluetooth devices near fleet vehicles with timing of suspicious infotainment behavior.

Monitoring Recommendations

For fleet operators, maintain an inventory of XAV-AX8500 firmware versions and audit them against the latest Sony software update.
Where feasible, disable Bluetooth discoverability on the receiver when not actively pairing a trusted device.
Track Sony's advisory page for further firmware revisions and ZDI updates to the ZDI-25-358 advisory.

How to Mitigate CVE-2025-5820

Immediate Actions Required

Apply the firmware update published by Sony for the XAV-AX8500 as documented in the Sony Software Update advisory.
Until the update is applied, keep the receiver out of Bluetooth discoverable mode and avoid initiating pairing in public areas.
Review and remove unrecognized devices from the receiver's paired device list.

Patch Information

Sony has published a firmware update for the XAV-AX8500 that addresses the ERTM channel initialization flaw. The update is available through the Sony XAV-AX8500 support page. Owners should follow Sony's documented installation procedure, which typically involves downloading the firmware image to USB media and applying it through the receiver's update menu.

Workarounds

Disable Bluetooth on the XAV-AX8500 entirely when wireless connectivity is not required.
Restrict pairing to environments where no unknown Bluetooth devices are within range.
For commercial fleets, prioritize firmware deployment on vehicles operating in high-density urban areas where adjacent-network exposure is greatest.

bash

# No command-line configuration applies to this embedded device.
# Apply the vendor firmware update through the head unit's USB update procedure
# as described in Sony advisory 00344092.