CVE-2026-66732 describes a missing source address validation vulnerability in the ConnectionManager component of Eukaryot's Sonic 3 A.I.R. software before commit 2492d18 (affecting versions <=26.03.28.0). The vulnerability arises because established connections are identified solely by a two-byte local connection handle without verifying that the datagram source address matches the registered remote address. An attacker positioned on-path who can observe cleartext UDP traffic can exploit this by forging the two-byte connection identifier to inject arbitrary packets into any established session. This enables session termination via TerminateConnectionPacket, arbitrary channel message forgery, and forged request responses without requiring IP address spoofing.

An attacker with on-path access to cleartext UDP traffic can inject arbitrary packets into established sessions, potentially terminating sessions, forging messages, and sending forged responses. This compromises session integrity and availability without needing IP spoofing, increasing the risk of session disruption and unauthorized message injection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Until a fix is available, minimizing exposure to on-path attackers and encrypting UDP traffic where possible may reduce risk.