Critical Zero‑Day RCE (CVE‑2026‑4149) in Sonos Era 300 Smart Speaker Threatens Enterprise Networks

Critical Zero‑Day RCE (CVE‑2026‑4149) in Sonos Era 300 Smart Speaker Threatens Enterprise Networks

What It Is – A newly disclosed out‑of‑bounds write‑up in the SMB response handling of the Sonos Era 300 smart speaker (CVE‑2026‑4149) permits unauthenticated remote code execution with kernel‑level privileges.

Exploitability – The flaw is actively exploitable; proof‑of‑concept code has been shared with the vendor. CVSS 3.1 base score 10.0 (Critical).

Affected Products – Sonos Era 300 (firmware < 83.1‑61240).

TPRM Impact – Organizations that deploy Sonos speakers in offices, hotels, retail spaces, or conference rooms inherit a direct attack surface into their internal network. A compromised speaker can be leveraged to pivot, exfiltrate data, or disrupt critical services, representing a supply‑chain risk for third‑party risk managers.

Recommended Actions –

1. Verify firmware version on all Sonos Era 300 devices; upgrade immediately to 83.1‑61240 or later.
2. Isolate audio‑system VLANs from core corporate networks; enforce strict firewall rules on SMB ports (445/TCP).
3. Update asset inventories to include consumer‑grade IoT devices and assess their exposure.
4. Incorporate Sonos as a monitored asset in endpoint‑detection‑and‑response (EDR) platforms.
5. Review contracts with facilities‑management vendors to ensure they follow patch‑management best practices for IoT.

Source: Zero Day Initiative Advisory – ZDI‑26‑192