Information Disclosure Vulnerability in Sonos One Speaker

CVE-2023-27353

What is CVE-2023-27353?

This vulnerability in the Sonos One Speaker enables network-adjacent attackers to access sensitive information without authentication. It stems from a flaw in the msprox endpoint, where user-supplied data is not properly validated. This oversight allows unauthorized users to exploit the weakness, potentially leading to reading beyond allocated buffer limits. Attackers can exploit this vulnerability alongside other security issues to execute arbitrary code with root-level privileges, jeopardizing the integrity of the system.

References