CVE-2023-50810 — n/a / n/a

Description (CNA)

In certain Sonos products before Sonos S1 Release 11.12 and S2 release 15.9, a vulnerability exists in the U-Boot component of the firmware that allow persistent arbitrary code execution with Linux kernel privileges. A failure to correctly handle the return value of the setenv command can be used to override the kernel command-line parameters and ultimately bypass the Secure Boot implementation. This affects PLAY5 gen 2, PLAYBASE, PLAY:1, One, One SL, and Amp.

Affected (CNA)

Vendor / product	Versions
n/a / n/a	affected n/a

CWE

No CWE identifiers supplied.

References

https://www.sonos.com/en-us/security-advisory-2024-0001

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.