Sonos smart speakers flaw allowed to eavesdrop on users
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-50809 | In certain Sonos products before S1 Release 11.12 and S2 release 15.9, the mt_7615.ko wireless driver does not properly validate an information element during n In certain Sonos products before S1 Release 11.12 and S2 release 15.9, the mt_7615.ko wireless driver does not properly validate an information element during negotiation of a WPA2 four-way handshake. This lack of validation leads to a stack buffer overflow. This can result in remote code execution within the kernel. This affects Amp, Arc, Arc SL, Beam, Beam Gen 2, Beam SL, and Five. NVD description · AI analysis pending | 7.8 | <1% | — | — | ||
| CVE-2024-20018 | In wlan driver, there is a possible out of bounds write due to improper input validation. In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00348479; Issue ID: MSV-1019. NVD description · AI analysis pending | 9.8 | <1% |
| — |
Full article427 words · extracted from securityaffairs.com · click to collapse
NCC Group discovered vulnerabilities in Sonos smart speakers, including a flaw that could have allowed to eavesdrop on users.
Researchers from NCC Group have discovered multiple vulnerabilities in Sonos smart speakers, including a flaw, tracked as CVE-2023-50809, that could have allowed eavesdropping on users.
The researchers have disclosed the vulnerabilities during the BLACK HAT USA 2024 conference.
The vulnerability CVE-2023-50809 can be exploited by an attacker who is in the Wi-Fi range of the targeted Sonos smart speaker to achieve remote code execution and take over the device.
The flaw resides in the device’s wireless driver which fails to properly validate an information element while negotiating a WPA2 four-way handshake.
Successfully exploiting this flaw can allow attackers to record audio and exfiltrate it to the attacker’s server.
“A vulnerability exists in the affected devices wireless driver that does not properly validate an information element while negotiating a WPA2 four-way handshake.” reads the advisory. “A low-privileged, close-proximity attacker could exploit this vulnerability to remotely execute arbitrary code.”
The vendor addressed the vulnerability with the release of Sonos S2 release 15.9, it also informed customers that no workarounds are available.
MediaTek, who manufactures Wi-Fi SoC for Sonos speaker, released a security advisory in March 2024 (CVE-2024-20018).
NCC Group also published a whitepaper that provides details about the reverse engineering process and exploitation techniques that its experts used to achieve arbitrary code execution on both the Sonos Era-100 and the Sonos One devices.
“The paper is then split into two major sections, the first covering a memory corruption vulnerability which was identified within the WPA2 handshake process of the device’s wireless driver of the Sonos One. The driver itself was a third-party chipset by MediaTek who has now the associated patch with the March 2024 Security Bulletin (CVE-2024-20018). Within this section, we discuss the vulnerability itself and the steps necessary to exploit the issue as well as a detailed listing of techniques used to achieve code execution (such as an in-depth return orientated programming payload).” states NCC Group.
“After this, we describe the post-exploitation process of obtaining a full shell on the device and describe a novel implant which we developed for capturing audio from the device’s microphone. The other major section of the whitepaper is dedicated towards the Sonos Era-100 device. NCC Group previously identified weaknesses within the secure boot process on the device.”
Below is a video PoC of the attack exploring the flaw to eavesdrop on users.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Sonos Smart Speakers)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/166823/hacking/sonos-smart-speakers-flaw.html