CVE-2023-27353 - OpenCVE

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-35220. Authentication is not required to exploit this vulnerability. The specific flaw exists within the msprox endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-19846.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Sonos	One S2 S1 One Firmware

Configuration 1 [-]

AND

cpe:2.3:o:sonos:one_firmware:70.3-35220:*:*:*:*:*:*:*

cpe:2.3:h:sonos:one:-:*:*:*:*:*:*:*

Configuration 2 [-]

OR	cpe:2.3:a:sonos:s1::::::::
	cpe:2.3:a:sonos:s2::::::::

References

Link	Resource
https://www.zerodayinitiative.com/advisories/ZDI-23-448/	Third Party Advisory VDB Entry

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: zdi

Published: 2023-04-20T00:00:00

Updated: 2023-04-20T00:00:00

Reserved: 2023-02-28T00:00:00

Link: CVE-2023-27353

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-04-20T22:15:07.140

Modified: 2023-05-04T17:04:16.083

Link: CVE-2023-27353

JSON object: View

Redhat Information

No data.

CWE

CWE-125

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sonos:one_firmware:70.3-35220:*:*:*:*:*:*:*", "matchCriteriaId": "8EE4A7E8-95A0-494F-B183-0F89251A648F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sonos:one:-:*:*:*:*:*:*:*", "matchCriteriaId": "EDEFE769-D51B-4ED0-818F-DF1321164AA2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sonos:s1:*:*:*:*:*:*:*:*", "matchCriteriaId": "CCD7FC41-7174-40FF-9F79-F6D1F886B35E", "versionEndExcluding": "11.7.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:sonos:s2:*:*:*:*:*:*:*:*", "matchCriteriaId": "5071BA4F-7418-438F-8B5F-3956B18C7AD0", "versionEndExcluding": "15.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-35220. Authentication is not required to exploit this vulnerability. The specific flaw exists within the msprox endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-19846."}], "id": "CVE-2023-27353", "lastModified": "2023-05-04T17:04:16.083", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-04-20T22:15:07.140", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-448/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "zdi-disclosures@trendmicro.com", "type": "Primary"}]}