Cyber Posture

CVE-2025-11783

Critical

Published: 02 December 2025

Published
02 December 2025
Modified
03 December 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0017 37.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The vulnerability is found in the 'AddEvent()' function when copying the user-controlled username input to a fixed-size buffer (48 bytes) without boundary checking. This can lead to memory corruption, resulting in possible…

more

remote code execution.

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-2 requires timely identification, reporting, and correction of software flaws, directly mitigating this CVE by patching the buffer overflow in the AddEvent() function.

prevent

SI-10 enforces information input validation at system entry points, preventing the stack-based buffer overflow by rejecting oversized user-controlled username inputs exceeding the 48-byte buffer.

prevent

SI-16 provides memory protection mechanisms such as ASLR and DEP, blocking successful exploitation of the buffer overflow for remote code execution despite memory corruption.

Security SummaryAI

CVE-2025-11783 is a stack-based buffer overflow vulnerability in Circutor SGE-PLC1000 and SGE-PLC50 devices running version 9.0.2. The flaw exists in the 'AddEvent()' function, which copies user-controlled username input into a fixed-size buffer of 48 bytes without boundary checking. This can cause memory corruption and potentially lead to remote code execution. The vulnerability is classified under CWE-121 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

A remote attacker requires no authentication or privileges and can exploit the vulnerability over the network with low attack complexity and no user interaction. By providing a maliciously crafted username input to the 'AddEvent()' function, the attacker triggers the buffer overflow, resulting in memory corruption. Successful exploitation enables remote code execution on the affected device, compromising confidentiality, integrity, and availability with high impact.

The INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products-0 details this and other vulnerabilities in Circutor products, including guidance on mitigation.

Details

CWE(s)

Affected Products

circutor
sge-plc1000 firmware
9.0.2
circutor
sge-plc50 firmware
9.0.2

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Unauthenticated remote buffer overflow leading to RCE on network-exposed PLC devices directly enables exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References