PT-2023-21076 · Sonos · Sonos One Speaker

Suto + 2 · Published 2023-04-14 · Updated 2023-05-04 · CVE-2023-27354

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sonos One Speaker version 70.3-35220

Description This issue allows network-adjacent attackers to disclose sensitive information on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the processing of the SMB directory query command. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before reading from memory. An attacker can leverage this in conjunction with other issues to execute arbitrary code in the context of root.

Recommendations For Sonos One Speaker version 70.3-35220, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2023-27354

ZDI-23-446

Affected Products

Sonos One Speaker

References · 6

• https://zerodayinitiative.com/advisories/ZDI-23-446 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27354 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27354 · Security Note
• https://t.me/cvenotify/48776 · Telegram Post
• https://t.me/cibsecurity/62567 · Telegram Post
• https://t.me/cvenotify/49806 · Telegram Post