CVE-2017-2913

An exploitable vulnerability exists in the filtering functionality of Circle with Disney. SSL certificates for specific domain names can cause the Bluecoat library to accept a different certificate than intended. An attacker can host an HTTPS server with this certificate to trigger this...

CVE-2017-2916

An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2017-2883

An exploitable vulnerability exists in the database update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the device to execute arbitrary code. An attacker needs to impersonate a remote server in order to trigger this vulnerability...

CVE-2017-2883

CVE-2017-2883 (Circle with Disney, firmware 2.0.1) : The vulnerability lies in the device’s database update functionality, which fetches a database archive over HTTP from an unauthenticated server. A remote attacker who can impersonate download.meetcircle.co can serve a malicious update archive c...

CVE-2017-2911

An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the rclient daemon to accept a different certificate than intended. An attacker can host an HTTPS server with this certificate...

CVE-2017-2912

CVE-2017-2912 affects Circle with Disney firmware 2.0.1 via the goclient SSL validation in the remote-control feature. The vulnerability arises because SSL certificate checking is insufficient: certificates for specific domains can cause goclient to accept an unintended certificate, enabling a MI...

CVE-2017-2898

The CVE-2017-2898 entry describes a real, exploitable vulnerability in Circle with Disney’s firmware update signature verification. An attacker can abuse the UPLOAD_FIRMWARE flow to install unsigned firmware via crafted network requests, potentially achieving arbitrary code execution. The attack ...

CVE-2017-2882

CVE-2017-2882 affects Circle with Disney devices (firmware 2.0.1) in the servers update functionality. Exploitation described where specially crafted network traffic, with impersonation of the remote update server, can cause the device to overwrite sensitive files and execute arbitrary code. Publ...

CVE-2017-2881

CVE-2017-2881 is an exploitable vulnerability in Circle with Disney firmware 2.0.1 affecting the torlist update feature. According to Talos/Seebug reports, specially crafted network packets can cause the device to execute an attacker-supplied shell script by intercepting and altering the torlist ...

CVE-2017-2866

CVE-2017-2866 (Circle with Disney) : Concrete details show an OS command injection in the backup API (/api/CONFIG/backup). The vulnerability arises when the attacker-controlled GET parameter appid is passed directly to system after assembling a shell command, allowing arbitrary command execution....

CVE-2017-2864

Circle with Disney devices contain CVE-2017-2864 where the authentication token generation is weak, allowing an attacker to trigger authentication bypass by sending crafted requests. The TALOS reports show the vulnerability chain: a GET parameter appid from the user is incorporated into a token f...

CVE-2017-12096

Summary: CVE-2017-12096 affects Circle with Disney. A crafted AP with the same SSID can force the device to connect to an attacker’s network, bypassing original network filtering. The vulnerability arises because Circle’s WiFi-management logic uses only the ESSID to identify the configured AP, ig...

CVE-2017-12085

CVE-2017-12085 is the Circle with Disney cloud routing vulnerability disclosed in TALOS-2017-0437. The issue enables an attacker with Internet connectivity to cause the Circle cloud to route a packet to an arbitrary Circle device via the cloud API and token-based routing mechanism. The attack cha...

CVE-2017-2865

An exploitable vulnerability exists in the firmware update functionality of Circle with Disney. Specially crafted network packets can cause the product to run an attacker-supplied shell script. An attacker can intercept and alter network traffic to trigger this vulnerability...

CVE-2017-2889

An exploitable Denial of Service vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A large amount of simultaneous TCP connections causes the APID daemon to repeatedly fork, causing the daemon to run out of memory and trigger a device reboot. An attacker needs...

CVE-2017-2866

An exploitable vulnerability exists in the /api/CONFIG/backup functionality of Circle with Disney. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2017-2882

An exploitable vulnerability exists in the servers update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the device to overwrite sensitive files, resulting in code execution. An attacker needs to impersonate a remote server in order to...

CVE-2017-2915

An exploitable vulnerability exists in the WiFi configuration functionality of Circle with Disney running firmware 2.0.1. A specially crafted SSID can cause the device to execute arbitrary shell commands. An attacker needs to send a couple of HTTP requests and setup an access point reachable by t...

CVE-2017-12085

An exploitable routing vulnerability exists in the Circle with Disney cloud infrastructure. A specially crafted packet can make the Circle cloud route a packet to any arbitrary Circle device. An attacker needs network connectivity to the Internet to trigger this vulnerability...

CVE-2017-12084

A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. A specific set of network packets can remotely start an SSH server on the device, resulting in a persistent backdoor. An attacker can send an API call to enable the SSH server...