CVE-2026-66732 Sonic 3 A.I.R. Missing Source Address Validation in ConnectionManager
An on-path attacker can inject packets into established sessions by forging connection identifiers, enabling message forgery and session termination.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-66732?
CVE-2026-66732 is a high-severity missing authorization vulnerability in Eukaryot sonic3air, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for the connection. An on-path attacker who can observe cleartext UDP traffic can inject arbitrary packets into any established session by forging the two-byte connection identifier, enabling session termination via TerminateConnectionPacket, arbitrary channel message forgery, and forged request responses without requiring IP address spoofing.
Weakness: CWE-346
Which versions are affected by CVE-2026-66732?
How do I fix CVE-2026-66732?
No fix has been published for CVE-2026-66732 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-66732 being exploited?
There is no known exploitation of CVE-2026-66732 in the wild and no public exploit code.
Sources
Also known as GHSA-pcww-cvpx-6v39.