CVE-2025-1049
published 2025-04-23CVE-2025-1049: Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on…
PriorityP357high8.8CVSS 3.0
AVAACLPRNUINSUCHIHAH
EPSS
0.35%
26.9th percentile
Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the processing of ID3 data. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the anacapa user. Was ZDI-CAN-25601.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aimstack | aim | 0 – 3.25.0 | — |
| sonos | era_300 | — | — |
| sonos | s1 | < 57.22-61162 | 57.22-61162 |
| sonos | s2 | < 83.1-61240 | 83.1-61240 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gj4f-mppc-xjrp: Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability
ghsa_unreviewed·2025-04-23
CVE-2025-1049 [HIGH] CWE-122 GHSA-gj4f-mppc-xjrp: Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability
Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the processing of ID3 data. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the anacapa user. Was ZDI-CAN-25601.
GHSA
Aim Excessive Data Query Operations in a Large Data Table vulnerability
ghsa·2025-03-20
CVE-2025-0190 [HIGH] CWE-1049 Aim Excessive Data Query Operations in a Large Data Table vulnerability
Aim Excessive Data Query Operations in a Large Data Table vulnerability
In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of `Text` objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these objects. This vulnerability can be exploited repeatedly, leading to a complete denial of service.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-04-23
Published