CVE-2017-12083 Information disclosure in Circle

What is CVE-2017-12083?

CVE-2017-12083 is a medium-severity vulnerability in Circle, published on 7 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An exploitable information disclosure vulnerability exists in the apid daemon of the Circle with Disney running firmware 2.0.1. A specially crafted set of packets can make the Disney Circle dump strings from an internal database into an HTTP response. An attacker needs network connectivity to the Internet to trigger this vulnerability.

Weakness: CWE-200

Which versions are affected by CVE-2017-12083?

It affects 1 product.

Products include Meetcircle Circle With Disney Firmware.

How do I fix CVE-2017-12083?

No fix has been published for CVE-2017-12083 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-12083 being exploited?

There is no known exploitation of CVE-2017-12083 in the wild and no public exploit code.

Other vulnerabilities in Circle

• CVE-2017-2866 Command injection in Circle Critical 9.9
• CVE-2017-2890 Command injection in Circle Critical 9.9
• CVE-2017-2898 Race condition in Circle Critical 9.9
• CVE-2017-2916 Path traversal in Circle Critical 9.9
• CVE-2017-2917 Command injection in Circle Critical 9.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mc2h-qwcm-2rr8.