CVE-2026-66732: Sonic 3 A.I.R. Missing Source Address Validation in ConnectionManager
Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for the connection. An on-path attacker who can observe cleartext UDP traffic can inject arbitrary packets into any established session by forging the two-byte connection identifier, enabling session termination via TerminateConnectionPacket, arbitrary channel message forgery, and forged request responses without requiring IP address spoofing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sonic 3 A.I.R. ConnectionManagerto a version that resolves this vulnerability.Fixed in commit 2492d18
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66732?
CVE-2026-66732 has a medium severity rating of 5.9.
How do I fix CVE-2026-66732?
To fix CVE-2026-66732, update Sonic 3 A.I.R. to the latest version that includes the source address validation fix.
What type of vulnerability is CVE-2026-66732?
CVE-2026-66732 is a missing source address validation vulnerability.
What can be exploited through CVE-2026-66732?
CVE-2026-66732 can potentially allow unauthorized connections due to the lack of source address verification.
In which component of Sonic 3 A.I.R. is CVE-2026-66732 found?
CVE-2026-66732 is found in the ConnectionManager component of Sonic 3 A.I.R.