PT-2025-48675 · Circutor · Circutor Sge-Plc1000/Sge-Plc50

Published 2025-12-02 · Updated 2025-12-30 · CVE-2025-11785

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2

Description A stack-based buffer overflow exists due to insufficient input validation. The GetParameter(meter) function retrieves user-supplied input, specifically the meter parameter, and copies it into a fixed-size buffer using sprintf() without proper size checks. The ShowMeterPasswords() function is also implicated in this issue. An attacker can exploit this by providing an excessively large input for the meter parameter, leading to a buffer overflow.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the size of the input accepted by the meter parameter in the GetParameter() function. Disable the ShowMeterPasswords() function until a patch is available.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2025-11785

Affected Products

Circutor Sge-Plc1000/Sge-Plc50

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-11785 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11785 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1995870733520490780 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products-0 · Note
• https://twitter.com/SecReportCVE/status/2005920908796375056 · Twitter Post
• https://t.me/CVEtracker/38664 · Telegram Post