CVE-2025-11779

Critical

Published: 02/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. The 'SetLan' function is invoked when a new configuration is applied, activated by a management web request to 'index.cgi'. Parameters are not sanitized, which could lead to command injection.

Risk Assessment

The risk includes potential remote command execution, which could allow an attacker to gain full control of the device and disrupt industrial processes.

Recommendation

It is recommended to apply vendor patches immediately and restrict access to the device management interface to trusted networks only.

Original NVD description (English source)

Stack-based buffer overflow vulnerability in CircutorSGE-PLC1000/SGE-PLC50 v9.0.2. The 'SetLan' function is invoked when a new configuration is applied. This new configuration function is activated by a management web request, which can be invoked by a user when making changes to the 'index.cgi' web application. The parameters are not being sanitised, which could lead to command injection.