High severity · published Aug 9, 2024
CVE-2023-50809
In certain Sonos products before S1 Release 11.12 and S2 release 15.9, the mt_7615.ko wireless driver does not properly validate an information element during negotiation of a…
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
In certain Sonos products before S1 Release 11.12 and S2 release 15.9, the mt_7615.ko wireless driver does not properly validate an information element during negotiation of a WPA2 four-way handshake. This lack of validation leads to a stack buffer overflow. This can result in remote code execution within the kernel. This affects Amp, Arc, Arc SL, Beam, Beam Gen 2, Beam SL, and Five.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
S2
S2 · Sonos
before 15.9 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-50809
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-50809
www.sonos.com
https://www.sonos.com/en-us/security-advisory-2024-0001
More from S2
9.8
CVE-2022-24049
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 (S2 systems) and 11.2.13 build 57923290 (S1…
8.8
CVE-2025-1050
Sonos Era 300 Out-of-Bounds Write Remote Code Execution Vulnerability
8.8
CVE-2025-1049
Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability
8.8
CVE-2025-1048
Sonos Era 300 Speaker libsmb2 Use-After-Free Remote Code Execution Vulnerability
8.8
CVE-2023-27355
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker 70.3-35220