CVE-2025-11778

Critical

Published: 02/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Stack-based buffer overflow in Circutor SGE-PLC1000/SGE-PLC50 version 0.9.2. This vulnerability allows an attacker to remotely exploit memory corruption through the 'read_packet()' function of the TACACSPLUS implementation.

Risk Assessment

The risk includes potential remote code execution or system crash, which can disrupt industrial operations and cause operational losses.

Recommendation

It is recommended to apply vendor patches immediately and restrict access to the device management interface to trusted networks only.

Original NVD description (English source)

Stack-based buffer overflow in Circutor SGE-PLC1000/SGE-PLC50 v0.9.2. This vulnerability allows an attacker to remotely exploit memory corruption through the 'read_packet()' function of the TACACSPLUS implementation.