CVE-2025-11784
CriticalSummary
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. In the 'ShowMeterDatabase()' function, user input is copied to a fixed-size buffer via 'sprintf()' without size validation. An attacker can provide an overly long 'meter' parameter, leading to buffer overflow.
Risk Assessment
The risk includes potential remote code execution or system crash, which can disrupt industrial operations and cause operational losses.
Recommendation
It is recommended to apply vendor patches immediately and restrict access to the device management interface to trusted networks only.
Other vulnerabilities in Circutor SGE-PLC1000/SGE-PLC50
See all- CVE-2025-11785Critical
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. In the 'ShowMeterPasswords()' function, user input is copied to a fixed-size buffer via 'sprintf()' without size validation. An attacker can provide an overly long 'meter' parameter, leading to buffer overflow.
- CVE-2025-11783Critical
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. In the 'AddEvent()' function, user-controlled username input is copied to a fixed-size buffer (48 bytes) without boundary checking. This can lead to memory corruption and potential remote code execution.
- CVE-2025-11782Critical
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. The 'ShowDownload()' function uses 'sprintf()' to format a string that includes user-controlled input from 'GetParameter(meter)' in a fixed-size buffer 'acStack_4c' (64 bytes) without checking length. An attacker can provide an overly long 'meter' parameter exceeding the buffer size.
- CVE-2025-11780Critical
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. In the 'showMeterReport()' function, user input is copied to a fixed-size buffer via 'sprintf()' without size validation. An attacker can provide an overly long 'meter' parameter, leading to buffer overflow.
- CVE-2025-11779Critical
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. The 'SetLan' function is invoked when a new configuration is applied, activated by a management web request to 'index.cgi'. Parameters are not sanitized, which could lead to command injection.
- CVE-2025-11778Critical
Stack-based buffer overflow in Circutor SGE-PLC1000/SGE-PLC50 version 0.9.2. This vulnerability allows an attacker to remotely exploit memory corruption through the 'read_packet()' function of the TACACSPLUS implementation.
Original NVD description (English source)
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowMeterDatabase()' function, there is an unlimited user input that is copied to a fixed-size buffer via 'sprintf()'. The 'GetParameter(meter)' function retrieves the user input, which is directly incorporated into a buffer without size validation. An attacker can provide an excessively large input for the 'meter' parameter.