Era 300 Firmware CVE-2025-1051

This vulnerability presents critical real-world risk across multiple dimensions: (1) CVSS 8.8 with AV:A (Adjacent Network) is appropriately severe—while requiring network proximity, the local network is a common attack surface for IoT devices in homes and offices; (2) AC:L (Low Complexity) and PR:N (No Privileges) indicate trivial exploitation—any unauthenticated attacker on the network segment can trigger the flaw; (3) UI:N (No User Interaction) required eliminates social engineering requirements; (4) S:U/C:H/I:H/A:H indicates full confidentiality, integrity, and availability compromise on the affected device. The attack vector (AV:A) moderates urgency slightly compared to AV:N vulnerabilities but does not significantly reduce risk in networked home/office environments. Without stated EPSS or KEV enrollment data, exploitation probability cannot be quantified precisely, but the low complexity and lack of privilege requirements suggest rapid weaponization is likely. The presence of a previous ZDI reference (ZDI-CAN-25865) indicates this was responsibly disclosed through a coordinated channel. This is a genuine priority vulnerability requiring prompt patching; it is not a high-CVSS-low-risk edge case.

An attacker on the same local network as a Sonos Era 300 speaker (e.g., compromised WiFi network, shared corporate network, or malicious neighbor on open WiFi) crafts a malicious ALAC audio frame with an oversized length field that exceeds the heap buffer allocation on the Era 300. The attacker sends this frame to the speaker via network audio streaming protocols (likely ALAC streaming over AirPlay or similar protocol). The vulnerable ALAC parser processes the frame without validating the length, causing a heap buffer overflow that overwrites adjacent heap memory structures. By carefully crafting the malicious payload, the attacker corrupts heap metadata or injects shellcode, achieving code execution in the anacapa user context. From this position, the attacker can: exfiltrate audio/microphone data if recording features are enabled, modify speaker behavior, use the speaker as a pivot point for further network attacks, or establish persistence. No user interaction is required—the attack triggers automatically upon frame receipt. While no public POC is referenced in the supplied data, the straightforward nature of heap overflow exploitation suggests POC development is relatively rapid once the vulnerability is disclosed to the security community.