PT-2017-15606 · Disney · Circle With Disney

Published 2017-11-07 · Updated 2022-06-13 · CVE-2017-2898

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Circle with Disney (affected versions not specified)

Description An issue exists in the signature verification of the firmware update functionality, allowing specially crafted network packets to cause an unsigned firmware to be installed, resulting in arbitrary code execution. An attacker can send a series of packets to trigger this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2017-2898

Affected Products

Circle With Disney

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0405 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-2898 · Security Note
• https://osv.dev/vulnerability/CVE-2017-2898 · Vendor Advisory
• https://t.me/cvenotify/31526 · Telegram Post