Remote Code Execution Flaw in Sonos Era 300 Speaker by Sonos

CVE-2025-1048

What is CVE-2025-1048?

A vulnerability in the Sonos Era 300 Speaker allows network-adjacent attackers to exploit a use-after-free condition in the processing of SMB data. This flaw arises from inadequate validation of object existence before performing operations. An attacker can potentially execute arbitrary code in the context of the anacapa user, posing serious risks to system integrity without needing authentication.

References