Pierluigi Paganini
August 10, 2024
Researchers from NCC Group have discovered multiple vulnerabilities in Sonos smart speakers, including a flaw, tracked as CVE-2023-50809, that could have allowed eavesdropping on users.
The researchers have disclosed the vulnerabilities during the BLACK HAT USA 2024 conference.
The vulnerability CVE-2023-50809 can be exploited by an attacker who is in the Wi-Fi range of the targeted Sonos smart speaker to achieve remote code execution and take over the device.
The flaw resides in the device’s wireless driver which fails to properly validate an information element while negotiating a WPA2 four-way handshake.
Successfully exploiting this flaw can allow attackers to record audio and exfiltrate it to the attacker’s server.
“A vulnerability exists in the affected devices wireless driver that does not properly validate an information element while negotiating a WPA2 four-way handshake.” reads the advisory. “A low-privileged, close-proximity attacker could exploit this vulnerability to remotely execute arbitrary code.”
The vendor addressed the vulnerability with the release of Sonos S2 release 15.9, it also informed customers that no workarounds are available.
MediaTek, who manufactures Wi-Fi SoC for Sonos speaker, released a security advisory in March 2024 (CVE-2024-20018).
NCC Group also published a whitepaper that provides details about the reverse engineering process and exploitation techniques that its experts used to achieve arbitrary code execution on both the Sonos Era-100 and the Sonos One devices.
“The paper is then split into two major sections, the first covering a memory corruption vulnerability which was identified within the WPA2 handshake process of the device’s wireless driver of the Sonos One. The driver itself was a third-party chipset by MediaTek who has now the associated patch with the March 2024 Security Bulletin (CVE-2024-20018). Within this section, we discuss the vulnerability itself and the steps necessary to exploit the issue as well as a detailed listing of techniques used to achieve code execution (such as an in-depth return orientated programming payload).” states NCC Group.
“After this, we describe the post-exploitation process of obtaining a full shell on the device and describe a novel implant which we developed for capturing audio from the device’s microphone. The other major section of the whitepaper is dedicated towards the Sonos Era-100 device. NCC Group previously identified weaknesses within the secure boot process on the device.”
Below is a video PoC of the attack exploring the flaw to eavesdrop on users.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Sonos Smart Speakers)
