CVE-2025-11786
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A stack-based buffer overflow vulnerability exists in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2 within the 'SetUserPassword()' function. The 'newPassword' parameter is embedded directly into a shell command string via 'sprintf()' without sanitisation and executed using 'system()', allowing injection of arbitrary shell commands.
Risk Assessment
An attacker can execute arbitrary system commands with the application's privileges, potentially leading to full device compromise and breach of data confidentiality and integrity.
Recommendation
Update the device firmware to a version where the vulnerability is fixed, or apply compensating controls to prevent access to the vulnerable function.
Other vulnerabilities in Circutor SGE-PLC1000/SGE-PLC50
See all- CVE-2025-11788Critical
A heap-based buffer overflow vulnerability exists in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2 within the 'ShowSupervisorParameters()' function. Unlimited user input is copied to a fixed-size buffer via 'sprintf()' without size validation, allowing an attacker to supply an excessively large 'meter' parameter.
- CVE-2025-11785Critical
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. In the 'ShowMeterPasswords()' function, user input is copied to a fixed-size buffer via 'sprintf()' without size validation. An attacker can provide an overly long 'meter' parameter, leading to buffer overflow.
- CVE-2025-11784Critical
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. In the 'ShowMeterDatabase()' function, user input is copied to a fixed-size buffer via 'sprintf()' without size validation. An attacker can provide an overly long 'meter' parameter, leading to buffer overflow.
- CVE-2025-11783Critical
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. In the 'AddEvent()' function, user-controlled username input is copied to a fixed-size buffer (48 bytes) without boundary checking. This can lead to memory corruption and potential remote code execution.
- CVE-2025-11782Critical
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. The 'ShowDownload()' function uses 'sprintf()' to format a string that includes user-controlled input from 'GetParameter(meter)' in a fixed-size buffer 'acStack_4c' (64 bytes) without checking length. An attacker can provide an overly long 'meter' parameter exceeding the buffer size.
- CVE-2025-11780Critical
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. In the 'showMeterReport()' function, user input is copied to a fixed-size buffer via 'sprintf()' without size validation. An attacker can provide an overly long 'meter' parameter, leading to buffer overflow.
- CVE-2025-11779Critical
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. The 'SetLan' function is invoked when a new configuration is applied, activated by a management web request to 'index.cgi'. Parameters are not sanitized, which could lead to command injection.
- CVE-2025-11778Critical
Stack-based buffer overflow in Circutor SGE-PLC1000/SGE-PLC50 version 0.9.2. This vulnerability allows an attacker to remotely exploit memory corruption through the 'read_packet()' function of the TACACSPLUS implementation.
- CVE-2025-11789High
Out-of-bounds read vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'DownloadFile' function converts a parameter to an integer using 'atoi()' and then uses it as an index in the 'FilesDownload' array with '(&FilesDownload)[iVar2]'. If the parameter is too large, it will access memory beyond the limits.
- CVE-2025-11787High
Command injection vulnerability in the operating system of Circutor SGE-PLC1000/SGE-PLC50 v9.0.2 through the 'GetDNS()', 'CheckPing()' and 'TraceRoute()' functions. This allows execution of arbitrary commands on the system.
Original NVD description (English source)
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'SetUserPassword()' function, the 'newPassword' parameter is directly embedded in a shell command string using 'sprintf()' without any sanitisation or validation, and then executed using 'system()'. This allows an attacker to inject arbitrary shell commands that will be executed with the same privileges as the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS