Skip to main content
manu_sonos
Contributor I
Oct 16, 2017 5:06 PM UTC
Answered

Is Sonos vulnerable to the KRACK-attack?

Hello,

since sonos devices use wifi, is the sonos software vulnerable to the following WPA2 attack?

https://www.krackattacks.com/

If so, will there be an update?

See also:

https://papers.mathyvanhoef.com/ccs2017.pdf
https://arstechnica.com/information-technology/2017/10/severe-flaw-in-wpa2-protocol-leaves-wi-fi-traffic-open-to-eavesdropping/
    This topic has been closed for further comments. You can use the search bar to find a similar topic, or create a new one by clicking Create Topic at the top of the page.
    Ryan S
    Ryan SAnswer
    Retired Sonos Staff
    Dec 13, 2017 12:03 AM UTC
    Sonos version 8.2.2 is available today for download and contains the fixes for our previously identified KRACK WPA2 vulnerabilities. Go ahead and check for updates and make sure your Sonos players and controllers all update to this version.

    You'll want to make sure all of your other wireless devices have received similar fixes from their manufacturers, if they were found to be vulnerable: such as routers, computers, and mobile devices.
    Mark good posts by pressing the like button, and select the best answer on questions you've asked to help others find solutions.
    View in thread

    17 replies

    Show previous replies
    fvanrijt
    Contributor I
    Oct 17, 2017 1:37 PM UTC
    Hi everyone,

    We're aware of the issues with WPA2 and our team is working to determine any ramifications this may have for Sonos players.

    We appreciate your concern and thanks for reaching out.

    Will you contact the CERT Org to get the CVE note updated once becomes clear whether or not (certain) Sonos devices are vulnerable. -> http://www.kb.cert.org/vuls/id/228519
    Translate
      Tom F
      Lyricist I
      Oct 20, 2017 5:04 AM UTC
      Definitley a client issue, looking forward to what you folks figure out.
      Translate
      ManueLaLoF
      Lyricist I
      Oct 20, 2017 1:25 PM UTC
      Hi, any news about this ?
      tks
      Translate
      Ryan S
      Ryan S
      Retired Sonos Staff
      Oct 20, 2017 5:47 PM UTC
      We have determined certain modes of operation are affected by issues described in the KRACK WPA2 vulnerability announcement (see https://www.krackattacks.com/ if you're not familiar already). The impact is primarily on Sonos systems configured to connect to your WiFi network directly.

      We're working on a firmware update to address these vulnerabilities which will be available as soon as testing is complete.
      Translate
      Mark good posts by pressing the like button, and select the best answer on questions you've asked to help others find solutions.
        Kevinkosta
        Lyricist I
        Nov 13, 2017 1:16 PM UTC
        When can we expect the new firmware to be available?
        Translate
        Stach
        Lyricist I
        Dec 5, 2017 10:27 PM UTC
        Since it's been over 1 month since Sonos last reply, what is the status of a firmware update to fix this vulnerability that we are fairly certain that Sonos has....since our players are wireless, support WPA2 and are clients?
        Translate
        Ryan S
        Ryan SAnswer
        Retired Sonos Staff
        Dec 13, 2017 12:03 AM UTC
        Sonos version 8.2.2 is available today for download and contains the fixes for our previously identified KRACK WPA2 vulnerabilities. Go ahead and check for updates and make sure your Sonos players and controllers all update to this version.

        You'll want to make sure all of your other wireless devices have received similar fixes from their manufacturers, if they were found to be vulnerable: such as routers, computers, and mobile devices.
        Translate
        Mark good posts by pressing the like button, and select the best answer on questions you've asked to help others find solutions.
          Terms & ConditionsAccessibility statement