CVE-2017-2915
HighSummary
A vulnerability exists in the WiFi configuration functionality of Circle with Disney running firmware 2.0.1, allowing execution of arbitrary shell commands via a specially crafted SSID. An attacker needs to send a couple of HTTP requests and set up an access point reachable by the device to exploit this vulnerability.
Risk Assessment
This vulnerability could lead to device takeover, posing a serious threat to home network security. An attacker could exploit this flaw to perform unauthorized actions.
Recommendation
It is recommended to update the device firmware to the latest version to mitigate this vulnerability. Additionally, monitor network traffic and restrict device access to trusted access points only.
Other vulnerabilities in Circle with Disney firmware 2.0.1
See all- CVE-2017-2917High
An exploitable vulnerability exists in the notifications functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection by sending an HTTP request.
- CVE-2017-2916High
An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten.
- CVE-2017-2890High
An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1, allowing OS command injection via specially crafted network packets. An attacker can send an HTTP request to trigger this vulnerability.
- CVE-2017-2884High
An exploitable vulnerability exists in the user photo update functionality of Circle with Disney running firmware 2.0.1. A repeated set of specially crafted API calls can cause the device to corrupt essential memory, resulting in a bricked device.
- CVE-2017-2883High
An exploitable vulnerability exists in the database update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the device to execute arbitrary code.
- CVE-2017-2882High
An exploitable vulnerability exists in the servers update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the device to overwrite sensitive files, resulting in code execution.
- CVE-2017-2881High
An exploitable vulnerability exists in the torlist update functionality of Circle with firmware 2.0.1. Specially crafted network packets can cause the product to run an attacker-supplied shell script.
- CVE-2017-12094High
An exploitable vulnerability exists in the WiFi Channel parsing of Circle with Disney running firmware 2.0.1. A specially crafted SSID can cause the device to execute arbitrary sed commands.
- CVE-2017-12084High
A backdoor vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. An attacker can send a specific set of network packets to remotely start an SSH server on the device, resulting in a persistent backdoor.
Original NVD description (English source)
An exploitable vulnerability exists in the WiFi configuration functionality of Circle with Disney running firmware 2.0.1. A specially crafted SSID can cause the device to execute arbitrary shell commands. An attacker needs to send a couple of HTTP requests and setup an access point reachable by the device to trigger this vulnerability.