What is CVE-2017-2914?

CVE-2017-2914 is a high-severity vulnerability in Circle Media, classified under Improper Authentication. CVSS score: 8.1/10. Published 2017-11-07.

How severe is CVE-2017-2914?

High severity. CVSS v3 base score is 8.1 out of 10.

Auth bypass in Circle Media

CVE-2017-2914

An exploitable authentication bypass vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A specially crafted token can bypass the authentication routine of the Apid binary, causing the device to grant unintended administrative access. An attacker needs network connectivity to the device to trigger this vulnerability.

Vulnerability class: Broken Authentication

EPSS: 0.016 (72.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Circle Media — versions firmware 2.0.1
Meetcircle Circle_with_disney
Meetcircle Circle_with_disney_firmware — versions 2.0.1

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

talos-cna@cisco.com (Technical Description, Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2017-2914?: CVE-2017-2914 is a high-severity vulnerability in Circle Media, classified under Improper Authentication. CVSS score: 8.1/10. Published 2017-11-07.
How severe is CVE-2017-2914?: High severity. CVSS v3 base score is 8.1 out of 10.