A number of safety flaws uncovered in Sonos One wi-fi audio system could possibly be probably exploited to attain data disclosure and distant code execution, the Zero Day Initiative (ZDI) said in a report revealed final week.
The vulnerabilities had been demonstrated by three totally different groups from Qrious Safe, STAR Labs, and DEVCORE on the Pwn2Own hacking contest held in Toronto late final 12 months, netting them $105,000 in financial rewards.
The listing of 4 flaws, which affect Sonos One Speaker 70.3-35220, is beneath –
- CVE-2023-27352 and CVE-2023-27355 (CVSS scores: 8.8) – Unauthenticated flaws that enable network-adjacent attackers to execute arbitrary code on affected installations.
- CVE-2023-27353 and CVE-2023-27354 (CVSS rating: 6.5) – Unauthenticated flaws that enable network-adjacent attackers to reveal delicate data on affected installations.
Whereas CVE-2023-27352 stems from when processing SMB listing question instructions, CVE-2023-27355 exists throughout the MPEG-TS parser.
Zero Belief + Deception: Be taught The best way to Outsmart Attackers!
Uncover how Deception can detect superior threats, cease lateral motion, and improve your Zero Belief technique. Be part of our insightful webinar!
Profitable exploitation of each shortcomings might allow an attacker to execute arbitrary code within the context of the foundation consumer.
Each the knowledge disclosure flaws may be mixed individually with different flaws within the programs to attain code execution with elevated privileges.
Following accountable disclosure on December 29, 2022, the issues had been addressed by Sonos as a part of Sonos S2 and S1 software program variations 15.1 and 11.7.1, respectively. Customers are really helpful to use the most recent patches to mitigate potential dangers.