Are Sonos products affected by the Airborne AirPlay exploit?

I haven’t had anybody else on my WiFi to check. Since it would require that access to my password protected WiFi, it really seems like if there is any threat at all, it’s super low. 

It’s not about the wifi password 🤦‍♀️If you have devices on your network that could be infected elsewhere (like iPhones and iPads either yours or guests) they could infect your Sonos devices. That would suck. Hopefully we can expect a patch in less time they are taking to bring back missing features to the app 😉

I’m not sure you read the link about the exploit. 

That is indeed the case for most home users, however Sonos are extensively used in various sizes of businesses, specifically within customer facing environments (like stores) where deployments can be less than secure.

Sonos really need to provide clear information to its users, hopefully Sonos Devices are not subject to the Airborne vulnerabilities.  I suspect this isn’t the case, given the broad nature of the SDK guidance and that nothing is within any Sonos release notes to address the issue.

This is the minimum that Sonos could do.

Although Apple have updated their own products, my understanding is that they only updated the AirPlay SDK that third parties use last month, so it may take a while for those changes to make it to Sonos devices.

However, as Bruce says, the risk is limited to those that already have access to your local network.

As far as cell phones and tablets are concerned the best option is to stay away from public hot spots like Starbucks, Airports and the like. As for visitors to your home limit them to a Guess network.

Speaking from the point of view of a cyber security professional with experience from the 1990’s, this is a problematic topic that isn’t so simple.  Sonos device aren’t just used by consumers or home offices, they are extensively deployed into many small businesses and also larger enterprises.  

Consider a hotel network, where the devices are installed for guest use.  
Consider the Smart TV with Airplay in a conference room that also has Sonos for audio 

Just two scenarios off the top of my head that require rather open access to visitors, that could yield highly negative outcomes.  

The five CVEs involved in this CVE-2025-24252, 24206, 24132 & 24271 are all recognised as a severity of critical.  With recommendations to either patch, or if unable to turn off airplay, block network ports TCP 5000, 7000, 7100, 3689 & UDP 5353.

Now as to allowing enough time, Sonos should have already patched this (and might have well have already patched), or at least offering guidance to users.  Guidance that is lacking at this point.

https://www.sonos.com/en-us/security-advisory
 

Consider that Apple has already patched the vulnerabilities, and vast majority of Apple consumers will have updated their Apple devices, so risk is significantly reduced in your scenario. Also, I would expect that the hotel and enterprise networks are guest isolated for guests and visitors.

I don’t think you understand a key element here, apples code actually runs as part of the Sonos speaker as the Airplay receiver, making the Sonos devices “possibly” at risk without any requirement for other apple devices.  And as network devices that run 24x7, this zero day and zero click vulnerability is a massive security hole.

It really doesn’t matter where the devices are deployed, Sonos needs to urgently advise customers if the devices are at risk, what do to in the interim and when they will fix (if required).  Not sure what the argument about this point is, does anyone think that Sonos should’t be advising?

Of course I understand that all AirPlay devices are running Apple SDK. I am trying to understand the level of ‘risk’ your scenarios, EPSS is 0.02% probability of the CVE’s you listed being exploited in next 30 days. I don’t see how this is a ‘massive security hole’?

I don't think its normal for software vendors to announce they have potential low risk vulnerabilities before an update is available.