PT-2017-15612 · Disney · Circle With Disney

Published 2017-11-07 · Updated 2022-06-13 · CVE-2017-2915

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Circle with Disney version 2.0.1

Description A specially crafted SSID can cause the device to execute arbitrary shell commands, due to an issue in the WiFi configuration functionality. An attacker needs to send a couple of HTTP requests and set up an access point reachable by the device to trigger this issue.

Recommendations For Circle with Disney version 2.0.1, consider disabling the WiFi configuration functionality until a patch is available. Restrict access to the device's network to minimize the risk of exploitation. Avoid using public or untrusted WiFi networks with the device until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2017-2915

Affected Products

Circle With Disney

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0422 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-2915 · Security Note
• https://osv.dev/vulnerability/CVE-2017-2915 · Vendor Advisory
• https://t.me/cvenotify/31531 · Telegram Post