Hackers Win $105,000 for Reporting Critical Security Flaws in Sonos One Speakers

Multiple security flaws uncovered in Sonos 1 wireless speakers could be probably exploited to accomplish facts disclosure and remote code execution, the Zero Day Initiative (ZDI) stated in a report released final week.

The vulnerabilities ended up demonstrated by a few diverse groups from Qrious Secure, STAR Labs, and DEVCORE at the Pwn2Personal hacking contest held in Toronto late last calendar year, netting them $105,000 in monetary rewards.

The checklist of 4 flaws, which effect Sonos A person Speaker 70.3-35220, is below –

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

• CVE-2023-27352 and CVE-2023-27355 (CVSS scores: 8.8) – Unauthenticated flaws that let network-adjacent attackers to execute arbitrary code on influenced installations.
• CVE-2023-27353 and CVE-2023-27354 (CVSS rating: 6.5) – Unauthenticated flaws that allow for network-adjacent attackers to disclose sensitive info on impacted installations.

When CVE-2023-27352 stems from when processing SMB directory question instructions, CVE-2023-27355 exists within just the MPEG-TS parser.

Forthcoming WEBINAR Zero Have faith in + Deception: Discover How to Outsmart Attackers!

Explore how Deception can detect advanced threats, prevent lateral motion, and enrich your Zero Have faith in strategy. Join our insightful webinar!

Preserve My Seat!.ad-button,.advert-label,.advert-label:followingdisplay screen:inline-block.advert_two_webinarmargin:20px 10px 30px 0background:#f9fbffcolor:#160755padding: 5%border:2px reliable #d9deffborder-radius:10pxtext-align:leftbox-shadow:10px 10px #e2ebff-webkit-border-best-left-radius:25px-moz-border-radius-topleft:25px-webkit-border-bottom-right-radius:25px-moz-border-radius-bottomright:25px.advert-labelfont-size:13pxmargin:20px 0font-bodyweight:600letter-spacing:.6pxcolor:#596cec.ad-label:afterwidth:50pxheight:6pxcontent:”border-best:2px strong #d9deffmargin: 8px.advertisement-titlefont-dimension:21pxpadding:10px 0font-body weight:900textual content-align:leftline-peak:33px.ad-descriptiontextual content-align:leftfont-dimensions:15.6pxline-top:26pxmargin:5px !importantcolor:#4e6a8d.advertisement-buttonpadding:6px 12pxborder-radius:5pxbackground-colour:#4469f5font-size:15pxcolor:#fff!importantborder:0line-peak:inherittext-decoration:none!importantcursor:pointermargin:15px 20pxfloat:leftfont-fat:500letter-spacing:.2px

Effective exploitation of both of those shortcomings could allow an attacker to execute arbitrary code in the context of the root person.

Each the info disclosure flaws can be merged separately with other flaws in the devices to attain code execution with elevated privileges.

Subsequent liable disclosure on December 29, 2022, the flaws were being tackled by Sonos as portion of Sonos S2 and S1 software package versions 15.1 and 11.7.1, respectively. Consumers are recommended to use the most current patches to mitigate likely dangers.

Discovered this article fascinating? Stick to us on Twitter  and LinkedIn to read a lot more exceptional written content we submit.