CVE-2017-12084
HighSummary
A backdoor vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. An attacker can send a specific set of network packets to remotely start an SSH server on the device, resulting in a persistent backdoor.
Risk Assessment
This vulnerability poses a serious security risk, allowing attackers remote access to the device and potential control over it.
Recommendation
It is recommended to update the firmware to the latest version to mitigate this vulnerability and to monitor network traffic for unauthorized access attempts.
Other vulnerabilities in Circle with Disney firmware 2.0.1
See all- CVE-2017-2917High
An exploitable vulnerability exists in the notifications functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection by sending an HTTP request.
- CVE-2017-2916High
An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten.
- CVE-2017-2915High
A vulnerability exists in the WiFi configuration functionality of Circle with Disney running firmware 2.0.1, allowing execution of arbitrary shell commands via a specially crafted SSID. An attacker needs to send a couple of HTTP requests and set up an access point reachable by the device to exploit this vulnerability.
- CVE-2017-2890High
An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1, allowing OS command injection via specially crafted network packets. An attacker can send an HTTP request to trigger this vulnerability.
- CVE-2017-2884High
An exploitable vulnerability exists in the user photo update functionality of Circle with Disney running firmware 2.0.1. A repeated set of specially crafted API calls can cause the device to corrupt essential memory, resulting in a bricked device.
- CVE-2017-2883High
An exploitable vulnerability exists in the database update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the device to execute arbitrary code.
- CVE-2017-2882High
An exploitable vulnerability exists in the servers update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the device to overwrite sensitive files, resulting in code execution.
- CVE-2017-2881High
An exploitable vulnerability exists in the torlist update functionality of Circle with firmware 2.0.1. Specially crafted network packets can cause the product to run an attacker-supplied shell script.
- CVE-2017-12094High
An exploitable vulnerability exists in the WiFi Channel parsing of Circle with Disney running firmware 2.0.1. A specially crafted SSID can cause the device to execute arbitrary sed commands.
Original NVD description (English source)
A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. A specific set of network packets can remotely start an SSH server on the device, resulting in a persistent backdoor. An attacker can send an API call to enable the SSH server.