CVE-2017-2865 CRITICAL

CVE-2017-2865

Vendor Circle Media
Product Circle
Published November 7, 2017
Last update September 16, 2024

CVSS base score

9.6/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

An exploitable vulnerability exists in the firmware update functionality of Circle with Disney. Specially crafted network packets can cause the product to run an attacker-supplied shell script. An attacker can intercept and alter network traffic to trigger this vulnerability.

Key dates

02Disclosure timeline

November 7, 2017 CVE published
September 16, 2024 Record updated