CVE-2017-12094
HighSummary
An exploitable vulnerability exists in the WiFi Channel parsing of Circle with Disney running firmware 2.0.1. A specially crafted SSID can cause the device to execute arbitrary sed commands.
Risk Assessment
An attacker can set up an access point reachable by the device, allowing for remote execution of unauthorized commands. This poses a significant security threat to the network.
Recommendation
It is recommended to update the device's firmware to the latest version to mitigate this vulnerability. Additionally, access to the device should be restricted to trusted access points.
Other vulnerabilities in Circle with Disney firmware 2.0.1
See all- CVE-2017-2917High
An exploitable vulnerability exists in the notifications functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection by sending an HTTP request.
- CVE-2017-2916High
An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten.
- CVE-2017-2915High
A vulnerability exists in the WiFi configuration functionality of Circle with Disney running firmware 2.0.1, allowing execution of arbitrary shell commands via a specially crafted SSID. An attacker needs to send a couple of HTTP requests and set up an access point reachable by the device to exploit this vulnerability.
- CVE-2017-2890High
An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1, allowing OS command injection via specially crafted network packets. An attacker can send an HTTP request to trigger this vulnerability.
- CVE-2017-2884High
An exploitable vulnerability exists in the user photo update functionality of Circle with Disney running firmware 2.0.1. A repeated set of specially crafted API calls can cause the device to corrupt essential memory, resulting in a bricked device.
- CVE-2017-2883High
An exploitable vulnerability exists in the database update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the device to execute arbitrary code.
- CVE-2017-2882High
An exploitable vulnerability exists in the servers update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the device to overwrite sensitive files, resulting in code execution.
- CVE-2017-2881High
An exploitable vulnerability exists in the torlist update functionality of Circle with firmware 2.0.1. Specially crafted network packets can cause the product to run an attacker-supplied shell script.
- CVE-2017-12084High
A backdoor vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. An attacker can send a specific set of network packets to remotely start an SSH server on the device, resulting in a persistent backdoor.
Original NVD description (English source)
An exploitable vulnerability exists in the WiFi Channel parsing of Circle with Disney running firmware 2.0.1. A specially crafted SSID can cause the device to execute arbitrary sed commands. An attacker needs to setup an access point reachable by the device to trigger this vulnerability.