EUVD-2026-21627
GHSA-8v6v-j22p-w63g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeploy rogue SMB server on network
-
DeliveryEra 300 initiates SMB connection for media access
-
ExploitSend crafted SMB response with malicious DataOffset
-
ExecutionTrigger out-of-bounds buffer write in kernel SMB parser
-
ImpactExecute arbitrary code with kernel privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker sends crafted SMB response with malicious DataOffset field to Sonos Era 300. No user interaction required. Affects default configurations; no special SMB settings or authentication needed. |
| Impact | This vulnerability presents CRITICAL theoretical severity (CVSS 10.0) but MODERATE practical urgency based on cross-signal analysis. The CVSS vector confirms worst-case exploitation characteristics: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and scope change with full CIA impact (S:C/C:H/I:H/A:H). However, real-world risk factors temper urgency: EPSS 1.27% indicates low observed exploitation probability, no CISA KEV listing confirms no active campaigns, and the attack requires victim device to initiate SMB connection to attacker-controlled server. SSVC factors show exploitation is currently PROOF-OF-CONCEPT level (ZDI published technical details), automatable once weaponized, with TOTAL technical impact. Primary risk scenarios involve targeted attacks against high-value environments where Era 300 speakers connect to network shares, or mass exploitation if wormable propagation is developed. The 80th percentile EPSS suggests this vulnerability is more likely to be exploited than 80% of known CVEs, warranting prioritization despite lack of observed exploitation. |
| Exploit ScenarioDerived | An attacker operates a malicious SMB server on the local network or internet. When the Sonos Era 300 speaker attempts to access media content from network shares (either through user-configured libraries or automatic network discovery), the attacker's SMB server responds with a specially crafted message containing a manipulated DataOffset field that triggers out-of-bounds memory access. This buffer overflow enables the attacker to overwrite kernel memory structures and execute arbitrary code with kernel privileges, allowing installation of persistent backdoors, audio surveillance malware, or lateral movement tools to compromise other network devices. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 11, 2026
Remote code execution in Sonos Era 300 smart speakers (build 17.5/91.0-70070) allows unauthenticated network attackers to execute arbitrary kernel-level code via malformed SMB server responses. The vulnerability achieves maximum CVSS 10.0 severity due to network accessibility without authentication, low complexity, and kernel-level code execution with scope change. EPSS indicates 1.27% exploitation probability (80th percentile), suggesting moderate real-world risk. No active exploitation confirmed at time of analysis, though ZDI publication increases weaponization likelihood.
RemediationAI
Contact Sonos support immediately to determine patch availability status for Era 300 firmware, as no vendor-released patch version is independently confirmed from available data at time of analysis. Monitor Sonos security advisories at the official support portal for firmware updates addressing CVE-2026-4149 and ZDI-CAN-28345. As immediate risk mitigation, implement network segmentation to isolate Era 300 devices from untrusted networks and disable SMB client functionality if not required for intended use cases. Block outbound SMB traffic (TCP ports 445, 139) from Era 300 devices at network firewall to prevent connection to malicious SMB servers. For enterprise deployments, restrict Era 300 network access to trusted internal SMB shares only via whitelist ACLs. Consult ZDI advisory ZDI-26-192 for additional vendor coordination details at https://www.zerodayinitiative.com/advisories/ZDI-26-192/. Disable network file sharing features on Era 300 speakers until patched firmware is deployed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the Sonos Era 300's SMB (Server Message Block) client implementation, specifically in parsing the DataOffset field within SMB protocol responses. SMB is a network file sharing protocol typically used for media streaming and network storage access on smart speakers. The vulnerability stems from insufficient bounds checking (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) when processing server-supplied DataOffset values. When the Era 300 connects to a malicious SMB server, the attacker can supply a crafted DataOffset that causes the SMB client to read or write memory beyond allocated buffer boundaries. Because the SMB stack operates at kernel privilege level on the embedded firmware, successful exploitation grants kernel-mode code execution, enabling complete device compromise including persistent malware installation, surveillance capabilities, or use as a network pivot point.
Know when Era 300 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sonos Era 300. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of the DataOffset field within SMB responses. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the kernel. Was ZDI-CAN-28345.
Executive ViewAI
CVE-2026-4149 is a critical remote code execution vulnerability affecting Sonos Era 300 smart speakers that allows unauthenticated network attackers to execute arbitrary kernel-level code without user interaction, potentially compromising all confidentiality, integrity, and availability of affected devices and potentially lateral network access through compromised speakers.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable SMB protocol access to Era 300 devices via network segmentation and firewall rules blocking TCP ports 139 and 445; (2) Isolate affected devices to a restricted VLAN without production network access; (3) Monitor network traffic for anomalous SMB communications; (4) Consider temporary device shutdown until patch availability confirmed. Monitor Sonos security advisories and CISA for patch release notifications daily.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB