Lucene search
PRIOn knowledge basePRION:CVE-2023-27355HistoryApr 20, 2023 - 10:15 p.m.
Stack overflow
2023-04-2022:15:00
PRIOn knowledge base
www.prio-n.com
3
stack overflow
network-adjacent attackers
arbitrary code execution
authentication bypass
mpeg-ts parser
lack of data validation
fixed-length buffer
root context
zdi-can-19773
nvd
0.001 Low
EPSS
Percentile
26.3%
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker 70.3-35220. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MPEG-TS parser. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19773.
| CPE | Name | Operator | Version |
|---|---|---|---|
| one_firmware | eq | 70.3.35220 | |
| s1 | lt | 11.7.1 | |
| s2 | lt | 15.1 |
Related
cvelist
cvelist
CVE-2023-27355
2023-04-20 00:00:00
nvd
nvd
CVE-2023-27355
2023-04-20 22:15:07
zdi
zdi
cve
cve
CVE-2023-27355
2023-04-20 22:15:07
thn
thn