CVE-2025-1049

Deeper analysis

The vulnerability tracked as CVE-2025-1049 is a heap-based buffer overflow in the Sonos Era 300 speaker that permits remote code execution. It arises during processing of ID3 data when the firmware fails to validate the length of attacker-supplied input before copying it into a heap buffer, and it was originally reported as ZDI-CAN-25601. The flaw is reachable by network-adjacent attackers without authentication and results in code execution under the privileges of the anacapa user.

An attacker positioned on the same local network segment can send a crafted ID3 tag to an affected speaker and obtain arbitrary code execution. The CVSS 8.8 vector reflects the combination of adjacent-network access, low attack complexity, and the absence of required credentials or user interaction, allowing an unauthenticated adversary to achieve full control over the device in the context of the anacapa account.

The Zero Day Initiative advisory ZDI-25-224 is the primary public reference for this issue. EPSS for the CVE rose from a low baseline to a recorded peak of 0.0140, indicating increased exploitation interest after disclosure.