CVE-2017-2898

An exploitable vulnerability exists in the signature verification of the firmware update functionality of Circle with Disney. Specially crafted network packets can cause an unsigned firmware to be installed in the device resulting in arbitrary code execution. An attacker can send a series of...

CVE-2017-2915

CVE-2017-2915 (Circle with Disney) affects Circle with Disney firmware 2.0.1. The vulnerability lies in the WiFi configuration flow: the device reads SSID data from an AP scan and passes unsanitized values to a system() call via restart_wifi.sh, enabling an attacker to inject commands. The exploi...

CVE-2017-12083

CVE-2017-12083 affects the Circle with Disney apid daemon (firmware 2.0.1). A crafted HTTP request triggers a use-after-free via unsafe handling of HTTP header pointers and realloc-based growth of request buffers, enabling information disclosure from the internal database. The vulnerability hinge...

CVE-2017-12094

CVE-2017-12094 affects Circle with Disney devices running firmware 2.0.1. The vulnerability arises in the WiFi Channel parsing during startup: an attacker can craft an SSID that, via the hostapd/iwinfo flow, leads to executing arbitrary sed commands on the device. An authenticated attacker only n...

CVE-2017-2884

An exploitable vulnerability exists in the user photo update functionality of Circle with Disney running firmware 2.0.1. A repeated set of specially crafted API calls can cause the device to corrupt essential memory, resulting in a bricked device. An attacker needs network connectivity to the...

CVE-2017-2890

An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability...

CVE-2017-12096

An exploitable vulnerability exists in the WiFi management of Circle with Disney. A crafted Access Point with the same name as the legitimate one can be used to make Circle connect to an untrusted network. An attacker needs to setup an Access Point reachable by the device and to send a series of...

CVE-2017-2884

CVE-2017-2884 affects Circle with Disney devices running firmware 2.0.1. The vulnerability is in the user photo update API (/api/UPDATE/users/user/photo). The Ta los/Cisco advisory details that the server parses POST parameters and allocates a buffer for the remaining data, enabling memory corrup...

CVE-2017-2917

CVE-2017-2917 affects Circle with Disney devices (firmware 2.0.1). The vulnerability arises in the notifications subsystem during config restore: the backup’s configure.xml is copied to /mnt/shares/usr/bin/configure.xml and processed to enumerate entries under config/overall/activeNotifications....

CVE-2017-2911

An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the rclient daemon to accept a different certificate than intended. An attacker can host an HTTPS server with this certificate...

CVE-2017-2916

An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2017-2864

Circle with Disney devices contain CVE-2017-2864 where the authentication token generation is weak, allowing an attacker to trigger authentication bypass by sending crafted requests. The TALOS reports show the vulnerability chain: a GET parameter appid from the user is incorporated into a token f...

CVE-2017-2882

CVE-2017-2882 affects Circle with Disney devices (firmware 2.0.1) in the servers update functionality. Exploitation described where specially crafted network traffic, with impersonation of the remote update server, can cause the device to overwrite sensitive files and execute arbitrary code. Publ...

CVE-2017-2865

An exploitable vulnerability exists in the firmware update functionality of Circle with Disney. Specially crafted network packets can cause the product to run an attacker-supplied shell script. An attacker can intercept and alter network traffic to trigger this vulnerability...

CVE-2017-2883

CVE-2017-2883 (Circle with Disney, firmware 2.0.1) : The vulnerability lies in the device’s database update functionality, which fetches a database archive over HTTP from an unauthenticated server. A remote attacker who can impersonate download.meetcircle.co can serve a malicious update archive c...

CVE-2017-12096

Summary: CVE-2017-12096 affects Circle with Disney. A crafted AP with the same SSID can force the device to connect to an attacker’s network, bypassing original network filtering. The vulnerability arises because Circle’s WiFi-management logic uses only the ESSID to identify the configured AP, ig...

CVE-2017-2889

An exploitable Denial of Service vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A large amount of simultaneous TCP connections causes the APID daemon to repeatedly fork, causing the daemon to run out of memory and trigger a device reboot. An attacker needs...

CVE-2017-2912

CVE-2017-2912 affects Circle with Disney firmware 2.0.1 via the goclient SSL validation in the remote-control feature. The vulnerability arises because SSL certificate checking is insufficient: certificates for specific domains can cause goclient to accept an unintended certificate, enabling a MI...

CVE-2017-2866

An exploitable vulnerability exists in the /api/CONFIG/backup functionality of Circle with Disney. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2017-2883

An exploitable vulnerability exists in the database update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the device to execute arbitrary code. An attacker needs to impersonate a remote server in order to trigger this vulnerability...