CVE-2025-43916

Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirecturi containing userinfo in the authority component, which is not consistent with RFC 6819 section 5.2.3.5. An authorization code may be sent to an attacker-controlled destination. This might have...

Sonos api.sonos.com 安全漏洞

Sonos api.sonos.com is an interface service from Sonos, Inc. A security vulnerability exists in Sonos api.sonos.com version 2025-04-21 and earlier, which originates in the /login/v3/oauth endpoint that accepts a redirecturi containing user information, which could result in an authorization code...

PT-2025-17434 · Sonos · Sonos

Name of the Vulnerable Software and Affected Versions: Sonos versions through 2025-04-21 Description: The issue concerns the /login/v3/oauth endpoint, which accepts a redirect uri containing userinfo in the authority component. This is inconsistent with RFC 6819 section 5.2.3.5, potentially...

CVE-2025-43916

Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirecturi containing userinfo in the authority component, which is not consistent with RFC 6819 section 5.2.3.5. An authorization code may be sent to an attacker-controlled destination. This might have...

CVE-2025-43916

CVE-2025-43916 affects Sonos api.sonos.com (endpoint /login/v3/oauth). The flaw allows a redirect_uri containing userinfo in the authority component, violating RFC 6819 5.2.3.5 and potentially causing an authorization code to be sent to an attacker-controlled destination. Public-fix details are n...

(Pwn2Own) Sonos Era 300 Speaker libsmb2 Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SMB data. The issue results from the lack of validati...

(Pwn2Own) Sonos Era 300 Out-of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HLS playlist data. The issue results from the lack of proper validatio...

PT-2025-15879 · Sonos · Sonos Era 300

Name of the Vulnerable Software and Affected Versions: Sonos Era 300 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. The specific flaw exists within the processing of HLS playlist data, resulti...

(Pwn2Own) Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of ID3 data. The issue results from the lack of proper validation of the...

PT-2025-15877 · Sonos +1 · Sonos Era 300 Speaker +1

Name of the Vulnerable Software and Affected Versions: Sonos Era 300 Speaker affected versions not specified Description: The issue is related to a Use-After-Free Remote Code Execution Vulnerability in the libsmb2 component. This vulnerability was discovered by dungdm @ piers2 with Viettel Cyber...

CVE-2022-24049

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 S2 systems and 11.2.13 build 57923290 S1 systems. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ALAC audio codec...

CVE-2022-24046

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 S2 systems and 11.2.13 build 57923290 S1 systems. Authentication is not required to exploit this vulnerability. The specific flaw exists within the anacapd...

The vulnerability of the wireless network driver mt_7615.ko software for Sonos audio devices allows a hacker to execute arbitrary code.

The vulnerability of the wireless network driver mt7615.ko of Sonos audio devices is related to stack buffer overflow. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Sonos One Speakers S1 App < 11.2.3 build 57923290, S2 App < 13.4.1 Multiple Vulnerabilities

Sonos One speakers are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX = "cpe:/a:sonos:";...

Sonos One Speakers S1 App < 11.7.1, S2 App < 15.1 Multiple Vulnerabilities

Sonos One speakers are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX = "cpe:/a:sonos:";...

CVE-2023-50810

In certain Sonos products before Sonos S1 Release 11.12 and S2 release 15.9, a vulnerability exists in the U-Boot component of the firmware that allow persistent arbitrary code execution with Linux kernel privileges. A failure to correctly handle the return value of the setenv command can be used...

CVE-2023-50809

In certain Sonos products before S1 Release 11.12 and S2 release 15.9, the mt7615.ko wireless driver does not properly validate an information element during negotiation of a WPA2 four-way handshake. This lack of validation leads to a stack buffer overflow. This can result in remote code executio...

Sonos S1和Sonos S2 安全漏洞

Sonos S1 and Sonos S2 are both a range of smart speakers from US-based Sonos. A security vulnerability exists in Sonos S1 versions prior to 11.12 and Sonos S2 versions prior to 15.9, which stems from a failure to properly validate a message element during the negotiation of the WPA2 four-way...

Sonos S1和Sonos S2 安全漏洞

Sonos S1 and Sonos S2 are both a series of smart speakers from Sonos USA. A security vulnerability exists in Sonos S1 versions prior to 11.12, Sonos S2 versions prior to 15.9, which stems from allowing persistent execution of arbitrary code with Linux kernel privileges...

Sonos Speaker Flaws Could Have Let Remote Hackers Eavesdrop on Users

Cybersecurity researchers have uncovered weaknesses in Sonos smart speakers that could be exploited by malicious actors to clandestinely eavesdrop on users. The vulnerabilities "led to an entire break in the security of Sonos's secure boot process across a wide range of devices and remotely being...