CVE-2025-1048
CVSS 3.0 Score 8.8 of 10 (high)
Details
Published Apr 23, 2025
Updated: Apr 29, 2025
CWE ID 416
Summary
CVE-2025-1048 is a remote code execution vulnerability affecting Sonos Era 300 Speakers. The issue lies in the way the speakers process SMB data, where the absence of object validation preceding operations leads to a use-after-free condition. Network-adjacent attackers can exploit this vulnerability without authentication, gaining the ability to execute arbitrary code in the context of the anacapa user. This vulnerability, originally identified as ZDI-CAN-25535, poses a significant risk to affected installations.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.