SO
Vendor
Sonos
50
CVEs
0
On KEV
0
New 30D
Products
S29.8
S2
Sonos
10 CVEs0 on KEV0 new
S19.8
S1
Sonos
8 CVEs0 on KEV0 new
OS9.8
One Speaker
Sonos
6 CVEs0 on KEV0 new
E39.8
Era 300
Sonos
5 CVEs0 on KEV0 new
OF8.8
One Firmware
Sonos
5 CVEs0 on KEV0 new
E18.8
Era 100
Sonos
4 CVEs0 on KEV0 new
E18.8
Era 100 Firmware
Sonos
4 CVEs0 on KEV0 new
TR6.1
tract
sonos
3 CVEs0 on KEV0 new
E39.8
Era 300 Firmware
Sonos
2 CVEs0 on KEV0 new
SF9.6
Sonos Firmware
Sonos
2 CVEs0 on KEV0 new
AP3.4
api.sonos.com
Sonos
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-55093 | TR tract sonos | 6.1 | Sep 14 | tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load |
| CVE-2026-55832 | TR tract sonos | 6.1 | Sep 14 | Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx |
| CVE-2026-75093 | TR tract sonos | 4.3 | Aug 18 | sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size |
| CVE-2026-4149 | E3 Era 300 Sonos | 9.8 | Apr 11 | Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code Execution Vulnerability |
| CVE-2025-1051 | E3 Era 300 Sonos | 8.8 | Jun 2 | Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2025-1050 | E3 Era 300 Sonos | 8.8 | Apr 23 | Sonos Era 300 Out-of-Bounds Write Remote Code Execution Vulnerability |
| CVE-2025-1049 | E3 Era 300 Sonos | 8.8 | Apr 23 | Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2025-1048 | E3 Era 300 Sonos | 8.8 | Apr 23 | Sonos Era 300 Speaker libsmb2 Use-After-Free Remote Code Execution Vulnerability |
| CVE-2025-43916 | AP api.sonos.com Sonos | 3.4 | Apr 21 | Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing userinfo in the authority component, which is not consistent… |
| CVE-2023-50810 | SF Sonos Firmware Sonos | 6.0 | Aug 9 | In certain Sonos products before Sonos S1 Release 11.12 and S2 release 15.9, a vulnerability exists in the U-Boot component of the firmware that allow persistent arbitrary code… |
| CVE-2023-50809 | S2 S2 Sonos | 7.8 | Aug 9 | In certain Sonos products before S1 Release 11.12 and S2 release 15.9, the mt_7615.ko wireless driver does not properly validate an information element during negotiation of a… |
| CVE-2024-5269 | E1 Era 100 Sonos | 8.8 | Jun 6 | Sonos Era 100 SMB2 Message Handling Use-After-Free Remote Code Execution Vulnerability |
| CVE-2024-5268 | E1 Era 100 Sonos | 6.5 | Jun 6 | Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Read Information Disclosure Vulnerability |
| CVE-2024-5267 | E1 Era 100 Sonos | 8.8 | Jun 6 | Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Write Remote Code Execution Vulnerability |
| CVE-2024-5256 | E1 Era 100 Sonos | 4.3 | Jun 6 | Sonos Era 100 SMB2 Message Handling Integer Underflow Information Disclosure Vulnerability |
| CVE-2023-27352 | OS One Speaker Sonos | 8.8 | Apr 20 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker 70.3-35220 |
| CVE-2023-27355 | OS One Speaker Sonos | 8.8 | Apr 20 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker 70.3-35220 |
| CVE-2023-27354 | OS One Speaker Sonos | 6.5 | Apr 20 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-35220 |
| CVE-2023-27353 | OS One Speaker Sonos | 6.5 | Apr 20 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-35220 |
| CVE-2020-9285 | OF One Firmware Sonos | 6.8 | Oct 20 | Some versions of Sonos One (1st and 2nd generation) allow partial or full memory access via attacker controlled hardware that can be attached to the Mini-PCI Express slot on the… |
| CVE-2022-24049 | OS One Speaker Sonos | 9.8 | Feb 18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 (S2 systems) and 11.2.13 build 57923290 (S1… |
| CVE-2022-24046 | OS One Speaker Sonos | 8.8 | Feb 18 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 (S2 systems) and 11.2.13 build… |
| CVE-2018-11316 | SF Sonos Firmware Sonos | 9.6 | Jul 3 | The UPnP HTTP server on Sonos wireless speaker products allow unauthorized access via a DNS rebinding attack |