Circle with Disney Firmware Update Network Packet command injection

Summaryinfo

A vulnerability marked as critical has been reported in Circle with Disney. Affected by this vulnerability is an unknown functionality of the component Firmware Update Handler. Performing a manipulation as part of Network Packet results in command injection. This vulnerability is reported as CVE-2017-2865. The attacker must have access to the local network to execute the attack. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in Circle with Disney (Endpoint Management Software) (the affected version is unknown). This affects an unknown code of the component Firmware Update Handler. The manipulation as part of a Network Packet leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An exploitable vulnerability exists in the firmware update functionality of Circle with Disney. Specially crafted network packets can cause the product to run an attacker-supplied shell script. An attacker can intercept and alter network traffic to trigger this vulnerability.

The bug was discovered 10/31/2017. The weakness was disclosed 11/07/2017 (Website). The advisory is shared at talosintelligence.com. This vulnerability is uniquely identified as CVE-2017-2865 since 12/01/2016. The attack needs to be initiated within the local network. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 7 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-109201, VDB-109200, VDB-109199 and VDB-109198 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Endpoint Management Software

Name

• Circle with Disney

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion