Skip to main content

Shop

  • Headphones
  • Speakers
  • Portable Speakers
  • Home Theater
  • Speaker Sets
  • Soundbars
  • Gift Card
  • Accessories
  • Architectural
  • Components
  • Certified Refurbished
  • Shop all

Learn

  • How Sonos Works
  • Home Theater

Support

Radio

Business

Popular searches

  • 1
  • ace
  • amp
  • beam

My account

  • Profile
  • Orders
  • System
  • Upgrade
  • Offers
  • Subscriptions
  • Beta
  • Community
Logout
  • Shop
  • Learn
  • Support
  • Radio
  • Business
  • Sign in
Security Advisory: 2024-0001
Advisory ID: SSA-2024-0001
Severity: High
Issue Date: 2024-08-01
CVE(s): CVE-2023-50810, CVE-2023-50809

Synopsis: Recent software updates address multiple security vulnerabilities (CVE-2023-50810, CVE-2023-50809)

1. Impacted Products
  • All S1 and S2 Systems.

Affected versions: All releases prior to Sonos S2 release 15.9, and Sonos S1 release 11.12

2. Introduction
Multiple vulnerabilities were privately reported to Sonos. Updates are available to remediate these vulnerabilities in affected Sonos products.

3. Persistent Code Execution (CVE-2023-50810)
Description: A vulnerability exists in the U-Boot component of the firmware which would allow for persistent arbitrary code execution with Linux kernel privileges.
Known Attack Vectors: A malicious actor with physical access to the device or by obtaining write access to the flash memory through a separate runtime vulnerability may be able to exploit this.
Resolution: To remediate CVE-2023-50810 apply the update Sonos S2 release 15.9
Workarounds: None
Additional Documentation: None
Notes: None
Acknowledgments: Sonos would like to thank Alexander Plaskett and NCC Group for their responsible disclosure by reporting this issue to us.

4. Remote Code Execution (CVE-2023-50809)
Description: A vulnerability exists in the affected devices wireless driver that does not properly validate an information element while negotiating a WPA2 four-way handshake.
Known Attack Vectors: A low-privileged, close-proximity attacker could exploit this vulnerability to remotely execute arbitrary code.
Resolution: To remediate CVE-2023-50809 apply the update Sonos S2 release 15.9
Workarounds: None
Additional Documentation: The link to the MediaTek driver security advisory lives here: https://corp.mediatek.com/product-security-bulletin/March-2024
Notes: None
Acknowledgments: Sonos would like to thank Alexander Plaskett and NCC Group for their responsible disclosure by reporting this issue to us.
  • Our Company
  • News
  • Blog
  • Careers
  • Responsibility
  • Innovation
  • Manage Your Account
  • Order Status
  • Shipping and Delivery
  • Returns
  • Find a Store
  • Investors
  • Business Solutions
  • Works with Sonos
  • Developer Portal
  • Contact Us
  • Corporate Sales
  • Sonos Trades
  • Frontline Workers
  • Sonos App
  • Sonos Voice Control
  • Students
  • Upgrade
  • © 2025 Sonos, Inc.
  • Legal
  • Privacy statement
  • Accessibility
  • Conformity
  • Site map
  • Security acknowledgements
  • Cookie settings
  • Product Security Advisories
  • Argentina
  • Australia
  • België ― Belgique
  • Canada (English) ― Canada (Français)
  • Chile
  • 中国
  • Colombia
  • Danmark
  • Deutschland
  • España
  • France
  • India
  • Ireland
  • Italia
  • 日本
  • México
  • Nederland
  • New Zealand
  • Norge
  • Österreich
  • Polska
  • Schweiz ― Svizzera ― Suisse
  • Suomi
  • Sverige
  • United Kingdom
  • United States ― Estados Unidos
  • Other countries (English)