Sony vulnerabilities
Published CVEs affecting Sony products: 11 record(s), with severity, exploitation and fixes.
Bravia Signage 3Snc-cx600w Firmware 2Optical Disc Archive Software for Windows 2SNC-CX600W 2Snc-dh120t Firmware 1INZONE Hub 1PS4 1FeliCa IC chips 1
CVE-2026-59776
Medium · 6.8
CWE-325 Jul 21, 2026
Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips…
Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is exploited, information stored in the IC chip may be read or tampered with.
CVE-2026-50255
Medium · 6.7
CWE-276 Jun 16, 2026
Incorrect Default Permissions in Sony Optical Disc Archive Software for Windows
Incorrect default permissions issue exists in Optical Disc Archive Software for Windows 5.5.3 and earlier. If this vulnerability is exploited, arbitrary code may be executed with SYSTEM privileges.
CVE-2025-64390
High · 7.4
CWE-367 Jun 2, 2026
TOCTOU Race Condition in Sony PS4
A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. The BD-J (Blu-ray Disc Java) sandbox can be escaped through a malformed JAR file.
CVE-2020-36924
Medium · 6.1
CWE-829 Jan 6, 2026
Sony BRAVIA Digital Signage 1.7.8 Unauthenticated Remote File Inclusion
Sony BRAVIA Digital Signage 1.7.8 contains a remote file inclusion vulnerability that allows attackers to inject arbitrary client-side scripts through the content material URL parameter. Attackers can exploit this vulnerability to hijack user sessions, execute cross-site scripting code, and modify display content by manipulating the input material type.
CVE-2020-36923
Critical · 9.8
CWE-639 Jan 6, 2026
Sony BRAVIA Digital Signage 1.7.8 Client-Side Protection Bypass via IDOR
Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers can access hidden system resources like '/#/content-creation' by manipulating client-side access restrictions.
CVE-2020-36922
High · 7.5
CWE-497 Jan 6, 2026
Sony BRAVIA Digital Signage 1.7.8 Unauthenticated System API Information Disclosure
Sony BRAVIA Digital Signage 1.7.8 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive system details through API endpoints. Attackers can retrieve network interface information, server configurations, and system metadata by sending requests to the exposed system API.
CVE-2020-36885
Critical · 9.8
CWE-787 Dec 10, 2025
Sony IPELA Network Camera 1.82.01 Remote Stack Buffer Overflow via ftpclient.cgi
Sony IPELA Network Camera 1.82.01 contains a stack buffer overflow vulnerability in the ftpclient.cgi endpoint that allows remote attackers to execute arbitrary code. Attackers can exploit the vulnerability by sending a crafted POST request with oversized data to the FTP client functionality, potentially causing remote code execution or denial of service.
CVE-2025-64772
High · 7.8
CWE-427 Nov 30, 2025
Uncontrolled Search Path Element in Sony INZONE Hub
The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.
CVE-2025-64730
Medium · 6.1
CWE-79 Nov 25, 2025
Cross-site Scripting (XSS) in Sony Snc-cx600w Firmware
Cross-site scripting vulnerability exists in SNC-CX600W all versions. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the product.
CVE-2025-62497
Medium · 6.5
CWE-352 Nov 25, 2025
Cross-Site Request Forgery (CSRF) in Sony Snc-cx600w Firmware
Cross-site request forgery vulnerability exists in SNC-CX600W versions prior to Ver.2.8.0. If a user accesses a specially crafted webpage while logged in, unintended operations may be performed.
CVE-2025-62225
Medium · 6.7
CWE-428 Nov 5, 2025
Optical Disc Archive Software provided by Sony Corporation registers a Windows service…
Optical Disc Archive Software provided by Sony Corporation registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.