Executive brief
SonicCloudOrg sonic-agent, a component of the Sonic Cloud Platform used for mobile device testing and management, contains a security flaw in its authentication handling. An unauthenticated remote attacker can bypass security filters to inject and execute malicious code on the server. This could lead to a complete system takeover, unauthorized access to testing data, or disruption of the cloud testing infrastructure. The vendor has not released a patch, and the product is reportedly no longer supported.
Technical details
A code injection vulnerability exists in SonicCloudOrg sonic-agent versions up to and including 2.7.2. The flaw is located within the JWT Authentication Filter, specifically affecting the ExchangeController.java component in the sonic-server-controller module. The root cause is identified as a failure to properly authenticate critical functions (CWE-306) and improper neutralization of input (CWE-94), allowing an unauthenticated remote attacker to trigger code execution via the /exchange/send endpoint. A public exploit (PoC) has been disclosed. As the vendor has not responded and the product is considered unsupported, no official patch is expected.
Affected products
- SonicCloudOrg sonic-agent up to 2.7.2
Timeline
- 2026-07-12: advisory: NVD publication date
- 2026-07-12: disclosed: Public exploit disclosed on GitHub