The attackers can misuse security intervals in the Sonos speaker system to accept malicious codes and complete speakers. Updates are ready.
This is about a total of three security intervals, for which zero-day Initiative (ZDI) from Trend Micro has now published information together with Sonos. All three weaknesses recall classification as a significant safety risk and can only be used highly and can be used without pre -registration.
Sonos: Three high -rash safety intervals
Now the first of the reported security leaks goes back to the lack of examination in the processing of SMB data (ie from Windows Network release), is there any object before the sonos software.Cve 2025-1048Cvss 8.8risk “High“).. Some unexpected ID3 is a safety-packed problem in processing tags, such as those as those.Cve 2025-1049Cvss 8.8risk “High,
The situation is the same in the processing of HLS playlist data. Here, too, a proper investigation of the length of the data below is a proper investigation of the length of the user, which enables to write behind the end of a allocated data structure – the user “Anacpa” can be brought involuntarily to the execution of smuggling harmful codes (Cve-2025-1050Cvss 8.8risk “High,
The weaknesses of the ZDi have described the interval for the Sonos Era-300 system. now one Publicly accessible security notification from Sonos However, it suggests that all Sonos S1 and S2 systems, and here are released before the more accurate system V16.6 (build 83.1-61240) and releases the sonos S1 system V11.15.1 (Build 57.22-61162). Accordingly, weakens in Ireland as part of the 2024 PWN2OWN event in Ireland. One Instructions from sonos Discussions discusses how users can install available updates.
Last year, Sonos had to struggle with the unsuccessful start of the new Sonos app. A seven-point remedy Catalogs should help improve procedures and regain the confidence of the community.
(DMK)
