CVE-2017-12085

CVE-2017-12085 is the Circle with Disney cloud routing vulnerability disclosed in TALOS-2017-0437. The issue enables an attacker with Internet connectivity to cause the Circle cloud to route a packet to an arbitrary Circle device via the cloud API and token-based routing mechanism. The attack cha...

CVE-2017-2864

Circle with Disney devices contain CVE-2017-2864 where the authentication token generation is weak, allowing an attacker to trigger authentication bypass by sending crafted requests. The TALOS reports show the vulnerability chain: a GET parameter appid from the user is incorporated into a token f...

CVE-2017-2889

Summary (MODE C): CVE-2017-2889 affects Circle with Disney devices (Circle firmware 2.0.1) via the APID daemon. The vulnerability arises when the APID server handles a high volume of TCP connections, forking per connection and exhausting memory, which leads to a device reboot. Reported by Cisco T...

CVE-2017-12094

CVE-2017-12094 affects Circle with Disney devices running firmware 2.0.1. The vulnerability arises in the WiFi Channel parsing during startup: an attacker can craft an SSID that, via the hostapd/iwinfo flow, leads to executing arbitrary sed commands on the device. An authenticated attacker only n...

CVE-2017-2889

An exploitable Denial of Service vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A large amount of simultaneous TCP connections causes the APID daemon to repeatedly fork, causing the daemon to run out of memory and trigger a device reboot. An attacker needs...

CVE-2017-2915

CVE-2017-2915 (Circle with Disney) affects Circle with Disney firmware 2.0.1. The vulnerability lies in the WiFi configuration flow: the device reads SSID data from an AP scan and passes unsanitized values to a system() call via restart_wifi.sh, enabling an attacker to inject commands. The exploi...

CVE-2017-2913

CVE-2017-2913 affects Circle with Disney and specifically the libbluecoat.so SSL validation path. The TALOS/NVD entries describe an exploitable MITM-style issue where SSL certificates for certain domain names can cause the Blue Coat library to accept a different certificate than intended, enablin...

CVE-2017-2865

An exploitable vulnerability exists in the firmware update functionality of Circle with Disney. Specially crafted network packets can cause the product to run an attacker-supplied shell script. An attacker can intercept and alter network traffic to trigger this vulnerability...

CVE-2017-12083

CVE-2017-12083 affects the Circle with Disney apid daemon (firmware 2.0.1). A crafted HTTP request triggers a use-after-free via unsafe handling of HTTP header pointers and realloc-based growth of request buffers, enabling information disclosure from the internal database. The vulnerability hinge...

CVE-2017-2882

An exploitable vulnerability exists in the servers update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the device to overwrite sensitive files, resulting in code execution. An attacker needs to impersonate a remote server in order to...

CVE-2017-12084

Circle with Disney firmware 2.0.1 has a backdoor via its remote control (rclient) functionality. CVE-2017-12084 can be triggered by a specific set of network packets to remotely start an SSH server (Dropbear) on the device, creating a persistent backdoor. Exploitation path involves the Apid remot...

CVE-2017-2914

CVE-2017-2914 : Authentication bypass in Circle with Disney 2.0.1 APID daemon. A crafted token can bypass authentication, granting admin access over the network. Talos reports the bypass arises from token handling in the app_list flow, leaking appid and enabling bypass; a 0x2d token length condit...

CVE-2017-2882

CVE-2017-2882 affects Circle with Disney devices (firmware 2.0.1) in the servers update functionality. Exploitation described where specially crafted network traffic, with impersonation of the remote update server, can cause the device to overwrite sensitive files and execute arbitrary code. Publ...

CVE-2017-2865

CVE-2017-2865 is a documented Circle with Disney vulnerability in the firmware update functionality. Exploitation involves sending specially crafted network packets to trigger execution of an attacker-supplied shell script on the device, with the attacker able to intercept/alter traffic to trigge...

CVE-2017-2911

CVE-2017-2911 : Circle with Disney devices (firmware 2.0.1) expose a remote-control SSL validation flaw in rclient. The binary extracts the server certificate subject (X509_NAME_oneline) and prints it; a partial CN check against CN=*.meetcircle.com is performed via strstr, allowing an attacker to...

CVE-2017-2890

An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability...

CVE-2017-2884

CVE-2017-2884 affects Circle with Disney devices running firmware 2.0.1. The vulnerability is in the user photo update API (/api/UPDATE/users/user/photo). The Ta los/Cisco advisory details that the server parses POST parameters and allocates a buffer for the remaining data, enabling memory corrup...

CVE-2017-12083

An exploitable information disclosure vulnerability exists in the apid daemon of the Circle with Disney running firmware 2.0.1. A specially crafted set of packets can make the Disney Circle dump strings from an internal database into an HTTP response. An attacker needs network connectivity to the...

CVE-2017-12096

An exploitable vulnerability exists in the WiFi management of Circle with Disney. A crafted Access Point with the same name as the legitimate one can be used to make Circle connect to an untrusted network. An attacker needs to setup an Access Point reachable by the device and to send a series of...

CVE-2017-2883

An exploitable vulnerability exists in the database update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the device to execute arbitrary code. An attacker needs to impersonate a remote server in order to trigger this vulnerability...