CVE-2024-5268

🗓️ 06 Jun 2024 17:50:10Reported by zdiType

Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos Era 100 smart speakers. The specific flaw exists within the handling of SMB2 messages and results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to execute arbitrary code in the context of root

Reporter	Title	Published	Views	Family All 7
CNNVD	Sonos Security Breach	6 Jun 202400:00	–	cnnvd
Cvelist	CVE-2024-5268 Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Read Information Disclosure Vulnerability	6 Jun 202417:50	–	cvelist
EUVD	EUVD-2024-46505	3 Oct 202520:07	–	euvd
NVD	CVE-2024-5268	6 Jun 202418:15	–	nvd
Positive Technologies	PT-2024-35411 · Sonos · Sonos Era 100	31 May 202400:00	–	ptsecurity
Vulnrichment	CVE-2024-5268 Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Read Information Disclosure Vulnerability	6 Jun 202417:50	–	vulnrichment
Zero Day Initiative	(Pwn2Own) Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Read Information Disclosure Vulnerability	31 May 202400:00	–	zdi

NVD

Vulners

Node

sonos era_100_firmwareMatch15.9

AND

sonos era_100

[
  {
    "vendor": "Sonos",
    "product": "Era 100",
    "versions": [
      {
        "version": "15.9 (build 75146030)",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-24-544/

21 Nov 2024 09:47Current

4.6Medium risk

Vulners AI Score4.6

CVSS 3.16.5

CVSS 34.3

EPSS0.00458

SSVC

CWE-125