CVE-2017-2911

An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the rclient daemon to accept a different certificate than intended. An attacker can host an HTTPS server with this certificate to trigger this vulnerability.

Score

CVSS 3.0 9.0 Critical

Status

Modified - talos-cna@cisco.com

Published

2017-11-07

Last modified

2024-09-16

Weaknesses

CWE-297

Affected products

• Circle (Circle Media)
• Circle With Disney Firmware (Meetcircle)

References

• https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0418