An attacker who can physically reach the Sony XAV-9500ES can connect a specially crafted USB device. The faulty udev rule configuration then allows instantiation of USB device types that are normally restricted by the system’s authorization checks, enabling the attacker to execute actions normally protected by authentication. The weakness is an authorization control failure (CWE-285).

The vulnerability affects Sony XAV-9500ES units. No specific firmware or hardware revision is listed in the data; the flaw resides in the udev rule system present on all XAV-9500ES installations.

The CVSS score of 2.4 reflects only moderate severity, while the EPSS score is not provided and the flaw is not catalogued in CISA KEV, suggesting a lower likelihood of widespread exploitation. The vulnerability requires physical access to connect the malicious USB device; once connected, the attacker can bypass authorization checks. The need for direct physical presence limits the threat surface, but the potential to run restricted commands under elevated privileges remains a concern for compromised device functionality.