What is CVE-2017-2898?

CVE-2017-2898 is a high-severity vulnerability in Circle Media, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 7.5/10. Published 2017-11-07.

How severe is CVE-2017-2898?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Circle Media

CVE-2017-2898

An exploitable vulnerability exists in the signature verification of the firmware update functionality of Circle with Disney. Specially crafted network packets can cause an unsigned firmware to be installed in the device resulting in arbitrary code execution. An attacker can send a series of packets to trigger this vulnerability.

Vulnerability class: Race Condition

EPSS: 0.016 (72.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Circle Media — versions firmware 2.0.1
Meetcircle Circle_with_disney
Meetcircle Circle_with_disney_firmware — versions 2.0.1

Weakness classification (CWE)

CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

References

talos-cna@cisco.com (Technical Description, Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2017-2898?: CVE-2017-2898 is a high-severity vulnerability in Circle Media, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 7.5/10. Published 2017-11-07.
How severe is CVE-2017-2898?: High severity. CVSS v3 base score is 7.5 out of 10.