What is CVE-2017-2917?

CVE-2017-2917 is a high-severity vulnerability in Circle Media, classified under OS Command Injection. CVSS score: 8.8/10. Published 2017-11-07.

How severe is CVE-2017-2917?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Circle Media

CVE-2017-2917

An exploitable vulnerability exists in the notifications functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.032 (87.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Circle Media — versions firmware 2.0.1
Meetcircle Circle_with_disney
Meetcircle Circle_with_disney_firmware — versions 2.0.1

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

talos-cna@cisco.com (Technical Description, Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2017-2917?: CVE-2017-2917 is a high-severity vulnerability in Circle Media, classified under OS Command Injection. CVSS score: 8.8/10. Published 2017-11-07.
How severe is CVE-2017-2917?: High severity. CVSS v3 base score is 8.8 out of 10.