CVE-2017-2890
HighSummary
An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1, allowing OS command injection via specially crafted network packets. An attacker can send an HTTP request to trigger this vulnerability.
Risk Assessment
This vulnerability could lead to unauthorized command execution on the system, posing a significant security risk to the organization.
Recommendation
It is recommended to update the firmware to the latest version to mitigate this vulnerability and to monitor network traffic for potential attack attempts.
Other vulnerabilities in Circle with Disney firmware 2.0.1
See all- CVE-2017-2917High
An exploitable vulnerability exists in the notifications functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection by sending an HTTP request.
- CVE-2017-2916High
An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten.
- CVE-2017-2915High
A vulnerability exists in the WiFi configuration functionality of Circle with Disney running firmware 2.0.1, allowing execution of arbitrary shell commands via a specially crafted SSID. An attacker needs to send a couple of HTTP requests and set up an access point reachable by the device to exploit this vulnerability.
- CVE-2017-2884High
An exploitable vulnerability exists in the user photo update functionality of Circle with Disney running firmware 2.0.1. A repeated set of specially crafted API calls can cause the device to corrupt essential memory, resulting in a bricked device.
- CVE-2017-2883High
An exploitable vulnerability exists in the database update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the device to execute arbitrary code.
- CVE-2017-2882High
An exploitable vulnerability exists in the servers update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the device to overwrite sensitive files, resulting in code execution.
- CVE-2017-2881High
An exploitable vulnerability exists in the torlist update functionality of Circle with firmware 2.0.1. Specially crafted network packets can cause the product to run an attacker-supplied shell script.
- CVE-2017-12094High
An exploitable vulnerability exists in the WiFi Channel parsing of Circle with Disney running firmware 2.0.1. A specially crafted SSID can cause the device to execute arbitrary sed commands.
- CVE-2017-12084High
A backdoor vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. An attacker can send a specific set of network packets to remotely start an SSH server on the device, resulting in a persistent backdoor.
Original NVD description (English source)
An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability.