CVE: CVE-2020-9285

Export to Word

Some versions of Sonos One (1st and 2nd generation) allow partial or full memory access via attacker controlled hardware that can be attached to the Mini-PCI Express slot on the motherboard that hosts the WiFi card on the device.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.00039
Percentile: 0.10767

CVSS Scoring

CVSS v3.1 Score: 6.8

Severity: MEDIUM

Mapped CWE(s)

CWE-1191 : On-Chip Debug and Test Interface With Improper Access Control

All CAPEC(s)

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels

CAPEC(s) with Mapped TTPs

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
Mapped TTPs:
- T1574.010 : Services File Permissions Weakness
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
Mapped TTPs:
- T1574.010 : Services File Permissions Weakness

Mapped ATT&CK TTPs

T1574.010 : Services File Permissions Weakness
Kill Chain: persistence
T1574.010 : Services File Permissions Weakness
Kill Chain: persistence

Malware

BlackEnergy

APTs Threat Group Associations

Campaigns

Affected Products

cpe:2.3:o:sonos:one_firmware:-:*:*:*:*:*:*:*

← Back to Home