CVE-2026-66732

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for the connection. An on-path attacker who can observe cleartext UDP traffic can inject arbitrary packets into any established session by forging the two-byte connection identifier, enabling session termination via TerminateConnectionPacket, arbitrary channel message forgery, and forged request responses without requiring IP address spoofing.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f
https://www.vulncheck.com/advisories/sonic-3-a-i-r-missing-source-address-validation-in-connectionmanager

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Sonic 3 A.I.R. antes del commit 2492d18 contiene una vulnerabilidad de validación de dirección de origen faltante en ConnectionManager donde las conexiones establecidas se resuelven solo por un identificador de conexión local de dos bytes sin verificar que la dirección de origen del datagrama coincida con la dirección remota registrada para la conexión. Un atacante en la ruta que puede observar tráfico UDP en texto claro puede inyectar paquetes arbitrarios en cualquier sesión establecida falsificando el identificador de conexión de dos bytes, lo que permite la terminación de la sesión a través de TerminateConnectionPacket, la falsificación de mensajes de canal arbitrarios y respuestas a solicitudes falsificadas sin requerir suplantación de dirección IP.

Information

Published : 2026-08-06 13:18

Updated : 2026-10-24 16:10

NVD link : CVE-2026-66732

Mitre link : CVE-2026-66732

CVE.ORG link : CVE-2026-66732

JSON object : View

Products Affected

No product.

CWE

CWE-346

Origin Validation Error

{"id": "CVE-2026-66732", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66732", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T18:32:00.532088Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/Eukaryot/sonic3air", "vendor": "Eukaryot", "product": "sonic3air", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "26.03.28.0"}, {"status": "unaffected", "version": "2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f", "versionType": "git"}], "packageURL": "pkg:github/Eukaryot/sonic3air", "defaultStatus": "affected"}]}], "published": "2026-08-06T13:18:21.773", "references": [{"url": "https://github.com/Eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/sonic-3-a-i-r-missing-source-address-validation-in-connectionmanager", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for the connection. An on-path attacker who can observe cleartext UDP traffic can inject arbitrary packets into any established session by forging the two-byte connection identifier, enabling session termination via TerminateConnectionPacket, arbitrary channel message forgery, and forged request responses without requiring IP address spoofing."}, {"lang": "es", "value": "Sonic 3 A.I.R. antes del commit 2492d18 contiene una vulnerabilidad de validaci\u00f3n de direcci\u00f3n de origen faltante en ConnectionManager donde las conexiones establecidas se resuelven solo por un identificador de conexi\u00f3n local de dos bytes sin verificar que la direcci\u00f3n de origen del datagrama coincida con la direcci\u00f3n remota registrada para la conexi\u00f3n. Un atacante en la ruta que puede observar tr\u00e1fico UDP en texto claro puede inyectar paquetes arbitrarios en cualquier sesi\u00f3n establecida falsificando el identificador de conexi\u00f3n de dos bytes, lo que permite la terminaci\u00f3n de la sesi\u00f3n a trav\u00e9s de TerminateConnectionPacket, la falsificaci\u00f3n de mensajes de canal arbitrarios y respuestas a solicitudes falsificadas sin requerir suplantaci\u00f3n de direcci\u00f3n IP."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "disclosure@vulncheck.com"}