PT-2026-25833 · Sonos · Sonos Era 300

Published 2026-03-16 · Updated 2026-04-11 · CVE-2026-4149

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sonos Era 300 (affected versions not specified)

Description The Sonos Era 300 is affected by an out-of-bounds access issue related to SMB responses, potentially leading to remote code execution. The issue was discovered by dmdung of STAR Labs SG Pte. Ltd.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2026-4149

ZDI-26-192

Affected Products

Sonos Era 300

References · 5

• https://zerodayinitiative.com/advisories/ZDI-26-192 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4149 · Security Note
• https://twitter.com/ctiwatchcloud/status/2042935709749637176 · Twitter Post
• https://twitter.com/0dayPublishing/status/2042772028801855661 · Twitter Post
• https://twitter.com/TheZDIBugs/status/2033657621606212007 · Twitter Post