VULNERABILITY INTELLIGENCE

CVE-2017-2898

CVSS score7.5 HIGH
EPSS probability1.56%
CISA KEVNot currently listed
Published2017-11-07
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

An exploitable vulnerability exists in the signature verification of the firmware update functionality of Circle with Disney. Specially crafted network packets can cause an unsigned firmware to be installed in the device resulting in arbitrary code execution. An attacker can send a series of packets to trigger this vulnerability.

Weakness classification

  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Primary references