Some versions of Sonos One (1st and 2nd generation) allow partial or full memory access via attacker controlled hardware that can be attached to the Mini-PCI Express slot on the motherboard that hosts the WiFi card on the device.
No PoCs from references.
- https://github.com/Live-Hack-CVE/CVE-2020-9285