What is CVE-2017-2890?

CVE-2017-2890 is a high-severity vulnerability in Circle Media, classified under OS Command Injection. CVSS score: 8.8/10. Published 2017-11-07.

How severe is CVE-2017-2890?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Circle Media

CVE-2017-2890

An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.026 (84.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Circle Media — versions firmware 2.0.1
Meetcircle Circle_with_disney
Meetcircle Circle_with_disney_firmware — versions 2.0.1

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

talos-cna@cisco.com (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2017-2890?: CVE-2017-2890 is a high-severity vulnerability in Circle Media, classified under OS Command Injection. CVSS score: 8.8/10. Published 2017-11-07.
How severe is CVE-2017-2890?: High severity. CVSS v3 base score is 8.8 out of 10.