Looking at the Attack Surfaces of the Sony XAV-AX8500 Part 2

This post maps the Sony XAV-AX8500 head unit’s threat landscape, highlighting attack surfaces across USB (media parsing, wallpaper image handling, firmware updates), Bluetooth profiles, a secured Wi‑Fi access point exposing TCP 30515, and wired/wireless Android Auto and Apple CarPlay; it also lists potentially used open-source components (e.g., Python, Boost, Dropbear, LAME, mpg123 with known CVEs) to inform and inspire vulnerability research, with a promise of a follow-up focused on firmware details.