CVE-2017-2882

An exploitable vulnerability exists in the servers update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the device to overwrite sensitive files, resulting in code execution. An attacker needs to impersonate a remote server in order to...

CVE-2017-12084

Circle with Disney firmware 2.0.1 has a backdoor via its remote control (rclient) functionality. CVE-2017-12084 can be triggered by a specific set of network packets to remotely start an SSH server (Dropbear) on the device, creating a persistent backdoor. Exploitation path involves the Apid remot...

CVE-2017-2914

CVE-2017-2914 : Authentication bypass in Circle with Disney 2.0.1 APID daemon. A crafted token can bypass authentication, granting admin access over the network. Talos reports the bypass arises from token handling in the app_list flow, leaking appid and enabling bypass; a 0x2d token length condit...

CVE-2017-2882

CVE-2017-2882 affects Circle with Disney devices (firmware 2.0.1) in the servers update functionality. Exploitation described where specially crafted network traffic, with impersonation of the remote update server, can cause the device to overwrite sensitive files and execute arbitrary code. Publ...

CVE-2017-2865

CVE-2017-2865 is a documented Circle with Disney vulnerability in the firmware update functionality. Exploitation involves sending specially crafted network packets to trigger execution of an attacker-supplied shell script on the device, with the attacker able to intercept/alter traffic to trigge...

CVE-2017-2911

CVE-2017-2911 : Circle with Disney devices (firmware 2.0.1) expose a remote-control SSL validation flaw in rclient. The binary extracts the server certificate subject (X509_NAME_oneline) and prints it; a partial CN check against CN=*.meetcircle.com is performed via strstr, allowing an attacker to...

CVE-2017-2890

An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability...

CVE-2017-2884

CVE-2017-2884 affects Circle with Disney devices running firmware 2.0.1. The vulnerability is in the user photo update API (/api/UPDATE/users/user/photo). The Ta los/Cisco advisory details that the server parses POST parameters and allocates a buffer for the remaining data, enabling memory corrup...

CVE-2017-12083

An exploitable information disclosure vulnerability exists in the apid daemon of the Circle with Disney running firmware 2.0.1. A specially crafted set of packets can make the Disney Circle dump strings from an internal database into an HTTP response. An attacker needs network connectivity to the...

CVE-2017-12096

An exploitable vulnerability exists in the WiFi management of Circle with Disney. A crafted Access Point with the same name as the legitimate one can be used to make Circle connect to an untrusted network. An attacker needs to setup an Access Point reachable by the device and to send a series of...

CVE-2017-2883

An exploitable vulnerability exists in the database update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the device to execute arbitrary code. An attacker needs to impersonate a remote server in order to trigger this vulnerability...

CVE-2017-2883

CVE-2017-2883 (Circle with Disney, firmware 2.0.1) : The vulnerability lies in the device’s database update functionality, which fetches a database archive over HTTP from an unauthenticated server. A remote attacker who can impersonate download.meetcircle.co can serve a malicious update archive c...

CVE-2017-12096

Summary: CVE-2017-12096 affects Circle with Disney. A crafted AP with the same SSID can force the device to connect to an attacker’s network, bypassing original network filtering. The vulnerability arises because Circle’s WiFi-management logic uses only the ESSID to identify the configured AP, ig...

CVE-2017-2898

An exploitable vulnerability exists in the signature verification of the firmware update functionality of Circle with Disney. Specially crafted network packets can cause an unsigned firmware to be installed in the device resulting in arbitrary code execution. An attacker can send a series of...

CVE-2017-12085

An exploitable routing vulnerability exists in the Circle with Disney cloud infrastructure. A specially crafted packet can make the Circle cloud route a packet to any arbitrary Circle device. An attacker needs network connectivity to the Internet to trigger this vulnerability...

CVE-2017-2865

An exploitable vulnerability exists in the firmware update functionality of Circle with Disney. Specially crafted network packets can cause the product to run an attacker-supplied shell script. An attacker can intercept and alter network traffic to trigger this vulnerability...

CVE-2017-12084

A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. A specific set of network packets can remotely start an SSH server on the device, resulting in a persistent backdoor. An attacker can send an API call to enable the SSH server...

PT-2017-12349 · Disney · Circle With Disney

Name of the Vulnerable Software and Affected Versions: Circle with Disney affected versions not specified Description: A vulnerability exists in the WiFi management of Circle with Disney, allowing an attacker to connect the device to an untrusted network. This can be achieved by setting up a...

Circle with Disney Remote Code Execution Vulnerability

Circle with Disney is a set of network monitoring and management devices for monitoring children's online behavior from Circle Media, Inc. in the United States. A remote code execution vulnerability exists in the server update feature in Circle with Disney version 2.0.1. The vulnerability can be...

Circle with Disney Access Control Error Vulnerability

Circle with Disney is a set of internet monitoring and management devices from Circle Media, Inc. for monitoring children's internet behavior, and WiFi management is one of the WiFi management components. An access control error vulnerability exists in WiFi management in Circle with Disney versio...