CVE-2017-2898

An exploitable vulnerability exists in the signature verification of the firmware update functionality of Circle with Disney. Specially crafted network packets can cause an unsigned firmware to be installed in the device resulting in arbitrary code execution. An attacker can send a series of packets to trigger this vulnerability.

Score

CVSS 3.0 9.9 Critical

Status

Modified - talos-cna@cisco.com

Published

2017-11-07

Last modified

2024-09-16

Weaknesses

CWE-362

Affected products

• Circle (Circle Media)
• Circle With Disney Firmware (Meetcircle)

References

• https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0405