CVE-2017-2881

CVE-2017-2881 is an exploitable vulnerability in Circle with Disney firmware 2.0.1 affecting the torlist update feature. According to Talos/Seebug reports, specially crafted network packets can cause the device to execute an attacker-supplied shell script by intercepting and altering the torlist ...

CVE-2017-12083

CVE-2017-12083 affects the Circle with Disney apid daemon (firmware 2.0.1). A crafted HTTP request triggers a use-after-free via unsafe handling of HTTP header pointers and realloc-based growth of request buffers, enabling information disclosure from the internal database. The vulnerability hinge...

CVE-2017-2866

CVE-2017-2866 (Circle with Disney) : Concrete details show an OS command injection in the backup API (/api/CONFIG/backup). The vulnerability arises when the attacker-controlled GET parameter appid is passed directly to system after assembling a shell command, allowing arbitrary command execution....

CVE-2017-2898

The CVE-2017-2898 entry describes a real, exploitable vulnerability in Circle with Disney’s firmware update signature verification. An attacker can abuse the UPLOAD_FIRMWARE flow to install unsigned firmware via crafted network requests, potentially achieving arbitrary code execution. The attack ...

CVE-2017-2916

CVE-2017-2916 affects Circle with Disney devices running firmware 2.0.1. The vulnerability is in the /api/CONFIG/restore path, where a crafted backup can overwrite arbitrary files during restoration. The restore sequence decrypts a backup, extracts it to a temporary directory, validates contents,...

CVE-2017-2865

CVE-2017-2865 is a documented Circle with Disney vulnerability in the firmware update functionality. Exploitation involves sending specially crafted network packets to trigger execution of an attacker-supplied shell script on the device, with the attacker able to intercept/alter traffic to trigge...

CVE-2017-2882

CVE-2017-2882 affects Circle with Disney devices (firmware 2.0.1) in the servers update functionality. Exploitation described where specially crafted network traffic, with impersonation of the remote update server, can cause the device to overwrite sensitive files and execute arbitrary code. Publ...

CVE-2017-12084

Circle with Disney firmware 2.0.1 has a backdoor via its remote control (rclient) functionality. CVE-2017-12084 can be triggered by a specific set of network packets to remotely start an SSH server (Dropbear) on the device, creating a persistent backdoor. Exploitation path involves the Apid remot...

CVE-2017-2911

CVE-2017-2911 : Circle with Disney devices (firmware 2.0.1) expose a remote-control SSL validation flaw in rclient. The binary extracts the server certificate subject (X509_NAME_oneline) and prints it; a partial CN check against CN=*.meetcircle.com is performed via strstr, allowing an attacker to...

CVE-2017-2917

CVE-2017-2917 affects Circle with Disney devices (firmware 2.0.1). The vulnerability arises in the notifications subsystem during config restore: the backup’s configure.xml is copied to /mnt/shares/usr/bin/configure.xml and processed to enumerate entries under config/overall/activeNotifications....

CVE-2017-12096

Summary: CVE-2017-12096 affects Circle with Disney. A crafted AP with the same SSID can force the device to connect to an attacker’s network, bypassing original network filtering. The vulnerability arises because Circle’s WiFi-management logic uses only the ESSID to identify the configured AP, ig...

CVE-2017-12094

CVE-2017-12094 affects Circle with Disney devices running firmware 2.0.1. The vulnerability arises in the WiFi Channel parsing during startup: an attacker can craft an SSID that, via the hostapd/iwinfo flow, leads to executing arbitrary sed commands on the device. An authenticated attacker only n...

CVE-2017-2914

CVE-2017-2914 : Authentication bypass in Circle with Disney 2.0.1 APID daemon. A crafted token can bypass authentication, granting admin access over the network. Talos reports the bypass arises from token handling in the app_list flow, leaking appid and enabling bypass; a 0x2d token length condit...

CVE-2017-12085

CVE-2017-12085 is the Circle with Disney cloud routing vulnerability disclosed in TALOS-2017-0437. The issue enables an attacker with Internet connectivity to cause the Circle cloud to route a packet to an arbitrary Circle device via the cloud API and token-based routing mechanism. The attack cha...

CVE-2017-2864

Circle with Disney devices contain CVE-2017-2864 where the authentication token generation is weak, allowing an attacker to trigger authentication bypass by sending crafted requests. The TALOS reports show the vulnerability chain: a GET parameter appid from the user is incorporated into a token f...

CVE-2017-2884

CVE-2017-2884 affects Circle with Disney devices running firmware 2.0.1. The vulnerability is in the user photo update API (/api/UPDATE/users/user/photo). The Ta los/Cisco advisory details that the server parses POST parameters and allocates a buffer for the remaining data, enabling memory corrup...

CVE-2017-2889

Summary (MODE C): CVE-2017-2889 affects Circle with Disney devices (Circle firmware 2.0.1) via the APID daemon. The vulnerability arises when the APID server handles a high volume of TCP connections, forking per connection and exhausting memory, which leads to a device reboot. Reported by Cisco T...

CVE-2017-2890

The CVE-2017-2890 vulnerability affects Circle with Disney devices running firmware 2.0.1. The /api/CONFIG/restore endpoint is exploitable: the server builds a shell command using the user-supplied appid parameter without sanitization, leading to OS command injection when an authenticated user in...

CVE-2017-2915

CVE-2017-2915 (Circle with Disney) affects Circle with Disney firmware 2.0.1. The vulnerability lies in the WiFi configuration flow: the device reads SSID data from an AP scan and passes unsanitized values to a system() call via restart_wifi.sh, enabling an attacker to inject commands. The exploi...

CVE-2017-12095

The CVE-2017-12095 entry concerns Circle with Disney firmware 2.0.1 where the WiFi Access Point can be forced to become an AP with a default credential set. Talos details show exploitation via a de-auth packet sequence to trigger circle_ap.sh up, which launches hostapd with a fixed SSID Circle-, ...

CVE-2017-2913

CVE-2017-2913 affects Circle with Disney and specifically the libbluecoat.so SSL validation path. The TALOS/NVD entries describe an exploitable MITM-style issue where SSL certificates for certain domain names can cause the Blue Coat library to accept a different certificate than intended, enablin...

CVE-2017-2912

CVE-2017-2912 affects Circle with Disney firmware 2.0.1 via the goclient SSL validation in the remote-control feature. The vulnerability arises because SSL certificate checking is insufficient: certificates for specific domains can cause goclient to accept an unintended certificate, enabling a MI...

CVE-2017-2883

CVE-2017-2883 (Circle with Disney, firmware 2.0.1) : The vulnerability lies in the device’s database update functionality, which fetches a database archive over HTTP from an unauthenticated server. A remote attacker who can impersonate download.meetcircle.co can serve a malicious update archive c...