CVE-2025-11786 — Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50

CVE-2025-11786

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 PUBLISHED

Description (CNA)

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'SetUserPassword()' function, the 'newPassword' parameter is directly embedded in a shell command string using 'sprintf()' without any sanitisation or validation, and then executed using 'system()'. This allows an attacker to inject arbitrary shell commands that will be executed with the same privileges as the application.

Affected (CNA)

Vendor / product	Versions
SGE-PLC1000 SGE-PLC50 / Circutor	affected 9.0.2

CWE

CWE-121

References

https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products-0

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.