Loading vulnerability…
Secure Boot Bypass via U-Boot setenv in Sonos Devices
A vulnerability in the U-Boot component of certain Sonos products (PLAY5 gen 2, PLAYBASE, PLAY:1, One, One SL, and Amp) prior to S1 Release 11.12 and S2 Release 15.9 allows persistent arbitrary code execution with Linux kernel privileges. The vulnerability arises from improper handling of the return value of the setenv command, which can be exploited to override kernel command-line parameters and bypass the Secure Boot implementation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to persistently execute arbitrary code with kernel privileges, fully compromising the device. This includes the ability to bypass Secure Boot, undermining the device's trusted boot chain and enabling installation of malicious firmware or rootkits.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict physical and network access to the device to trusted users only, as exploitation likely requires local or privileged access. Monitor for unauthorized firmware modifications or unexpected device behavior.
Patch, then assume compromise.
Upgrade affected Sonos devices to S1 Release 11.12 or S2 Release 15.9 or later, which address the improper handling of setenv in U-Boot and restore the integrity of Secure Boot.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.