CVE-2017-2917

An exploitable vulnerability exists in the notifications functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2017-2912

An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the goclient daemon to accept a different certificate than intended. An attacker can host an HTTPS server with this certificat...

CVE-2017-12083

An exploitable information disclosure vulnerability exists in the apid daemon of the Circle with Disney running firmware 2.0.1. A specially crafted set of packets can make the Disney Circle dump strings from an internal database into an HTTP response. An attacker needs network connectivity to the...

CVE-2017-2864

An exploitable vulnerability exists in the generation of authentication token functionality of Circle with Disney. Specially crafted network packets can cause a valid authentication token to be returned to the attacker resulting in authentication bypass. An attacker can send a series of packets t...

CVE-2017-12084

Circle with Disney firmware 2.0.1 has a backdoor via its remote control (rclient) functionality. CVE-2017-12084 can be triggered by a specific set of network packets to remotely start an SSH server (Dropbear) on the device, creating a persistent backdoor. Exploitation path involves the Apid remot...

CVE-2017-2916

CVE-2017-2916 affects Circle with Disney devices running firmware 2.0.1. The vulnerability is in the /api/CONFIG/restore path, where a crafted backup can overwrite arbitrary files during restoration. The restore sequence decrypts a backup, extracts it to a temporary directory, validates contents,...

CVE-2017-2914

CVE-2017-2914 : Authentication bypass in Circle with Disney 2.0.1 APID daemon. A crafted token can bypass authentication, granting admin access over the network. Talos reports the bypass arises from token handling in the app_list flow, leaking appid and enabling bypass; a 0x2d token length condit...

CVE-2017-2913

CVE-2017-2913 affects Circle with Disney and specifically the libbluecoat.so SSL validation path. The TALOS/NVD entries describe an exploitable MITM-style issue where SSL certificates for certain domain names can cause the Blue Coat library to accept a different certificate than intended, enablin...

CVE-2017-2911

CVE-2017-2911 : Circle with Disney devices (firmware 2.0.1) expose a remote-control SSL validation flaw in rclient. The binary extracts the server certificate subject (X509_NAME_oneline) and prints it; a partial CN check against CN=*.meetcircle.com is performed via strstr, allowing an attacker to...

CVE-2017-2890

The CVE-2017-2890 vulnerability affects Circle with Disney devices running firmware 2.0.1. The /api/CONFIG/restore endpoint is exploitable: the server builds a shell command using the user-supplied appid parameter without sanitization, leading to OS command injection when an authenticated user in...

CVE-2017-2865

CVE-2017-2865 is a documented Circle with Disney vulnerability in the firmware update functionality. Exploitation involves sending specially crafted network packets to trigger execution of an attacker-supplied shell script on the device, with the attacker able to intercept/alter traffic to trigge...

PT-2017-12349 · Disney · Circle With Disney

Name of the Vulnerable Software and Affected Versions: Circle with Disney affected versions not specified Description: A vulnerability exists in the WiFi management of Circle with Disney, allowing an attacker to connect the device to an untrusted network. This can be achieved by setting up a...

Circle with Disney SSL TLS Man-in-the-Middle Attack Vulnerability (CNVD-2017-33184)

Circle with Disney is a set of network monitoring and management devices for monitoring children's online behavior from Circle Media, Inc. in the United States. An SSL TLS man-in-the-middle attack vulnerability exists in the remote control feature in Circle with Disney version 2.0.1. An attacker...

Circle with Disney Access Control Error Vulnerability

Circle with Disney is a set of internet monitoring and management devices from Circle Media, Inc. for monitoring children's internet behavior, and WiFi management is one of the WiFi management components. An access control error vulnerability exists in WiFi management in Circle with Disney versio...

Circle with Disney Routing Vulnerability

Circle with Disney is a set of network monitoring and management devices for monitoring children's online behavior from Circle Media, Inc. in the United States. A routing vulnerability exists in the cloud infrastructure in Circle with Disney version 2.0.1. An attacker can exploit this vulnerabili...

Circle with Disney Denial of Service Vulnerability (CNVD-2017-33240)

Circle with Disney is a set of network monitoring and management devices for monitoring children's online behavior from Circle Media, Inc. in the United States. A denial of service vulnerability exists in the API daemon in Circle with Disney version 2.0.1. The vulnerability can be exploited to...

Circle with Disney Information Disclosure Vulnerability

Circle with Disney is a set of network monitoring and management devices for monitoring children's online behavior from Circle Media, Inc. in the United States. An information disclosure vulnerability exists in the apid daemon in Circle with Disney version 2.0.1. The vulnerability can be exploite...

Circle with Disney Command Injection Vulnerability (CNVD-2017-33185)

Circle with Disney is a set of network monitoring and management devices for monitoring children's online behavior from Circle Media, Inc. in the United States. A command injection vulnerability exists in Circle with Disney. An attacker could exploit this vulnerability by intercepting and alterin...

Circle with Disney Security Bypass Vulnerability

Circle with Disney is a set of network monitoring and management devices for monitoring children's online behavior from Circle Media, Inc. in the United States. A security bypass vulnerability exists in the signature verification of the firmware update feature in Circle with Disney version 2.0.1...

Circle with Disney Command Injection Vulnerability

Circle with Disney is a set of network monitoring and management devices for monitoring children's online behavior from Circle Media, Inc. in the United States. A command injection vulnerability exists in the notification feature in Circle with Disney version 2.0.1. The vulnerability can be...