CVE-2025-11783
CriticalSummary
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. In the 'AddEvent()' function, user-controlled username input is copied to a fixed-size buffer (48 bytes) without boundary checking. This can lead to memory corruption and potential remote code execution.
Risk Assessment
The risk includes potential remote code execution, which could allow an attacker to gain full control of the device and disrupt industrial processes.
Recommendation
It is recommended to apply vendor patches immediately and restrict access to the device management interface to trusted networks only.
Original NVD description (English source)
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The vulnerability is found in the 'AddEvent()' function when copying the user-controlled username input to a fixed-size buffer (48 bytes) without boundary checking. This can lead to memory corruption, resulting in possible remote code execution.