CyberRota Analysis
AI-GeneratedThe vulnerability in Sonic 3 A.I.R. allows an on-path attacker to exploit a missing source address validation in the ConnectionManager, enabling them to inject arbitrary packets into established sessions by forging a two-byte connection identifier. This can lead to session termination, message forgery, and unauthorized responses, all without the need for IP address spoofing. Organizations using Sonic 3 A.I.R. should prioritize addressing this issue to mitigate potential session hijacking and data integrity risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for the connection. An on-path attacker who can observe cleartext UDP traffic can inject arbitrary packets into any established session by forging the two-byte connection identifier, enabling session termination via TerminateConnectionPacket, arbitrary channel message forgery, and forged request responses without requiring IP address spoofing.