PT-2017-12348 · Disney · Circle With Disney

Published 2017-11-07 · Updated 2022-04-19 · CVE-2017-12094

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Circle with Disney version 2.0.1

Description A vulnerability exists in the WiFi Channel parsing of the device. It can be exploited by a specially crafted SSID, which can cause the device to execute arbitrary sed commands. An attacker needs to set up an access point reachable by the device to trigger this issue.

Recommendations For version 2.0.1, consider restricting access to the device's WiFi capabilities until a patch is available. As a temporary workaround, avoid connecting the device to untrusted or unknown access points to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2017-12094

Affected Products

Circle With Disney

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0446 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-12094 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12094 · Vendor Advisory