ZDI-CAN-25606: ZDI-25-225: (Pwn2Own) Sonos Era 300 Out-of-Bounds Write Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HLS playlist data. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the anacapa user.
Other sources
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-1050.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-25606?
The severity of ZDI-CAN-25606 is rated at 8.8 on the CVSS scale.
How do I fix ZDI-CAN-25606?
Fixing ZDI-CAN-25606 requires applying the latest security updates provided by Sonos for the Era 300 model.
Who can exploit ZDI-CAN-25606?
Network-adjacent attackers can exploit ZDI-CAN-25606 without requiring authentication.
What are the consequences of exploiting ZDI-CAN-25606?
Exploiting ZDI-CAN-25606 allows attackers to execute arbitrary code on affected Sonos Era 300 speakers.
What version of the software is affected by ZDI-CAN-25606?
The vulnerability ZDI-CAN-25606 specifically affects the Sonos Era 300 speakers.