CVE-2017-12096 Security feature bypass in Circle
Attackers can force Circle devices to connect to malicious networks by spoofing deauth packets, bypassing WiFi security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-12096?
CVE-2017-12096 is a medium-severity vulnerability in Circle, published on 7 Nov 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An exploitable vulnerability exists in the WiFi management of Circle with Disney. A crafted Access Point with the same name as the legitimate one can be used to make Circle connect to an untrusted network. An attacker needs to setup an Access Point reachable by the device and to send a series of spoofed "deauth" packets to trigger this vulnerability.
Weakness: CWE-290
Which versions are affected by CVE-2017-12096?
It affects 1 product.
Products include Meetcircle Circle With Disney Firmware.
How do I fix CVE-2017-12096?
No fix has been published for CVE-2017-12096 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-12096 being exploited?
There is no known exploitation of CVE-2017-12096 in the wild and no public exploit code.
Other vulnerabilities in Circle
Sources
Also known as GHSA-3qqr-w7gm-52gv.