CVE-2026-66732

Name of the Vulnerable Software and Affected Versions Sonic 3 A.I.R. versions prior to commit 2492d18

Description A missing source address validation issue exists in the ConnectionManager where established connections are resolved using only a two-byte local connection handle. The system fails to verify if the datagram source address matches the registered remote address for the connection. An on-path attacker capable of observing cleartext UDP traffic can inject arbitrary packets into established sessions by forging the two-byte connection identifier. This allows for session termination via TerminateConnectionPacket, arbitrary channel message forgery, and forged request responses without the need for IP address spoofing.

Recommendations Update Sonic 3 A.I.R. to commit 2492d18 or a later version.