CVE-2017-2917

🗓️ 07 Nov 2017 16:00:00Reported by talosType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 57 Views🌐 WEB

An OS command injection vulnerability in Circle with Disney firmware 2.0.1 allows remote attackers to execute commands via specially crafted network packets

Reporter	Title	Published	Views	Family All 10
CNVD	Circle with Disney Command Injection Vulnerability	2 Nov 201700:00	–	cnvd
Cvelist	CVE-2017-2917	7 Nov 201716:00	–	cvelist
EUVD	EUVD-2017-12058	7 Oct 202500:30	–	euvd
NVD	CVE-2017-2917	7 Nov 201716:29	–	nvd
OSV	CVE-2017-2917	7 Nov 201716:29	–	osv
Prion	Command injection	7 Nov 201716:29	–	prion
seebug.org	Circle with Disney configure.xml Notifications Command Injection Vulnerability(CVE-2017-2917)	9 Nov 201700:00	–	seebug
Talos	Circle with Disney configure.xml Notifications Command Injection Vulnerability	31 Oct 201700:00	–	talos
Talos Blog	Vulnerability Spotlight: The Circle of a Bug’s Life	31 Oct 201712:04	–	talosblog
ThreatPost	Popular ‘Circle with Disney’ Parental Control System Riddled With 23 Vulnerabilities	31 Oct 201717:37	–	threatpost

NVD

Vulners

Node

meetcircle circle_with_disney_firmwareMatch2.0.1

AND

meetcircle circle_with_disneyMatch-

[
  {
    "product": "Circle",
    "vendor": "Circle Media",
    "versions": [
      {
        "status": "affected",
        "version": "firmware 2.0.1"
      }
    ]
  }
]

Source	Link
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2017-0424

Parameter	Position	Path	Description	CWE
token	request body	/api/CONFIG/restore	OS commandInjection via unsanitized notification id during configuration restore enabling arbitrary code execution	CWE-77
appid	request body	/api/CONFIG/restore	OS commandInjection via unsanitized notification id during configuration restore enabling arbitrary code execution	CWE-77
upload	request body	/api/CONFIG/restore	OS commandInjection via unsanitized notification id during configuration restore enabling arbitrary code execution	CWE-77