Hackers Win $105,000 for Reporting Critical Security Flaws in Sonos One Speakers

Multiple security flaws uncovered in Sonos 1 wireless speakers could be probably exploited to accomplish facts disclosure and remote code execution, the Zero Day Initiative (ZDI) stated in a report released final week.

The vulnerabilities ended up demonstrated by a few diverse groups from Qrious Secure, STAR Labs, and DEVCORE at the Pwn2Personal hacking contest held in Toronto late last calendar year, netting them $105,000 in monetary rewards.

The checklist of 4 flaws, which effect Sonos A person Speaker 70.3-35220, is below –

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

• CVE-2023-27352 and CVE-2023-27355 (CVSS scores: 8.8) – Unauthenticated flaws that let network-adjacent attackers to execute arbitrary code on influenced installations.
• CVE-2023-27353 and CVE-2023-27354 (CVSS rating: 6.5) – Unauthenticated flaws that allow for network-adjacent attackers to disclose sensitive info on impacted installations.

When CVE-2023-27352 stems from when processing SMB directory question instructions, CVE-2023-27355 exists within just the MPEG-TS parser.

Forthcoming WEBINAR Zero Have faith in + Deception: Discover How to Outsmart Attackers!

Explore how Deception can detect advanced threats, prevent lateral motion, and enrich your Zero Have faith in strategy. Join our insightful webinar!

Preserve My Seat!.ad-button,.advert-label,.advert-label:followingdisplay screen:inline-block.advert_two_webinarmargin:20px 10px 30px 0background:#f9fbffcolor:#160755padding: 5%border:2px reliable #d9deffborder-radius:10pxtext-align:leftbox-shadow:10px 10px #e2ebff-webkit-border-best-left-radius:25px-moz-border-radius-topleft:25px-webkit-border-bottom-right-radius:25px-moz-border-radius-bottomright:25px.advert-labelfont-size:13pxmargin:20px 0font-bodyweight:600letter-spacing:.6pxcolor:#596cec.ad-label:afterwidth:50pxheight:6pxcontent:”border-best:2px strong #d9deffmargin: 8px.advertisement-titlefont-dimension:21pxpadding:10px 0font-body weight:900textual content-align:leftline-peak:33px.ad-descriptiontextual content-align:leftfont-dimensions:15.6pxline-top:26pxmargin:5px !importantcolor:#4e6a8d.advertisement-buttonpadding:6px 12pxborder-radius:5pxbackground-colour:#4469f5font-size:15pxcolor:#fff!importantborder:0line-peak:inherittext-decoration:none!importantcursor:pointermargin:15px 20pxfloat:leftfont-fat:500letter-spacing:.2px

Effective exploitation of both of those shortcomings could allow an attacker to execute arbitrary code in the context of the root person.

Each the info disclosure flaws can be merged separately with other flaws in the devices to attain code execution with elevated privileges.

Subsequent liable disclosure on December 29, 2022, the flaws were being tackled by Sonos as portion of Sonos S2 and S1 software package versions 15.1 and 11.7.1, respectively. Consumers are recommended to use the most current patches to mitigate likely dangers.

Discovered this article fascinating? Stick to us on Twitter  and LinkedIn to read a lot more exceptional written content we submit.