CVE-2025-11783
Published: 02 December 2025
Description
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The vulnerability is found in the 'AddEvent()' function when copying the user-controlled username input to a fixed-size buffer (48 bytes) without boundary checking. This can lead to memory corruption, resulting in possible…
more
remote code execution.
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely identification, reporting, and correction of software flaws, directly mitigating this CVE by patching the buffer overflow in the AddEvent() function.
SI-10 enforces information input validation at system entry points, preventing the stack-based buffer overflow by rejecting oversized user-controlled username inputs exceeding the 48-byte buffer.
SI-16 provides memory protection mechanisms such as ASLR and DEP, blocking successful exploitation of the buffer overflow for remote code execution despite memory corruption.
Security SummaryAI
CVE-2025-11783 is a stack-based buffer overflow vulnerability in Circutor SGE-PLC1000 and SGE-PLC50 devices running version 9.0.2. The flaw exists in the 'AddEvent()' function, which copies user-controlled username input into a fixed-size buffer of 48 bytes without boundary checking. This can cause memory corruption and potentially lead to remote code execution. The vulnerability is classified under CWE-121 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A remote attacker requires no authentication or privileges and can exploit the vulnerability over the network with low attack complexity and no user interaction. By providing a maliciously crafted username input to the 'AddEvent()' function, the attacker triggers the buffer overflow, resulting in memory corruption. Successful exploitation enables remote code execution on the affected device, compromising confidentiality, integrity, and availability with high impact.
The INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products-0 details this and other vulnerabilities in Circutor products, including guidance on mitigation.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote buffer overflow leading to RCE on network-exposed PLC devices directly enables exploitation of a public-facing application.