{"id":"CVE-2017-2916","aliases":["EUVD-2017-12057","GHSA-4pgp-x4g6-96cg"],"status":"published","title":"An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with...","description":"An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten. An attacker can send an HTTP request to trigger this vulnerability.","severity":{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.02251,"percentile":0.83013,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-59"],"published":"2017-11-07T16:00:00Z","modified":"2026-06-17T01:17:07Z","products":[{"vendor":"circle media","product":"circle"},{"vendor":"meetcircle","product":"circle_with_disney_firmware"}],"references":[{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0423","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2916"},{"url":"https://github.com/advisories/GHSA-4pgp-x4g6-96cg"}],"sources":{"cve":[{"id":"CVE-2017-2916","description":"An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten. An attacker can send an HTTP request to trigger this vulnerability.","status":"published","published":"2017-11-07T16:00:00Z","modified":"2024-09-17T04:00:28.316Z","cvss":[{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"updated_at":"2026-11-02T14:33:15.887816Z"}],"euvd":[{"id":"EUVD-2017-12057","description":"An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten. An attacker can send an HTTP request to trigger this vulnerability.","status":"published","published":"2017-11-07T16:00:00Z","modified":"2024-09-17T04:00:28Z","cvss":[{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:28:26.623918Z"}],"ghsa":[{"id":"GHSA-4pgp-x4g6-96cg","title":"An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with...","description":"An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten. An attacker can send an HTTP request to trigger this vulnerability.","status":"published","published":"2022-05-13T01:01:12Z","modified":"2023-01-27T05:02:15Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:42:02.011098Z"}],"nvd":[{"id":"CVE-2017-2916","description":"An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten. An attacker can send an HTTP request to trigger this vulnerability.","status":"published","published":"2017-11-07T16:29:01.137Z","modified":"2026-06-17T01:17:07.797Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:04:08.01771Z"}]}}