CVE-2025-11779CWE-121

CVE-2025-11779

Critical · published December 2, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
69.6
In the wild
Unconfirmed
What it is

🚨 A stack-based buffer overflow in CircutorSGE-PLC1000/SGE-PLC50 v9.0.2 is a ticking time bomb waiting to be triggered by a crafty request! 🔥 Think of it like a waiter taking a customer’s order without writing anything down. If the customer asks for a complicated dish and the waiter mishears, the kitchen could end up serving something completely different—or worse, something harmful! If exploited, an attacker could inject malicious commands directly into the system, potentially compromising control of the PLC devices. This could lead to catastrophic failures in industrial operations, causing downtime or even damage to physical equipment.

Put simply

Think of it like a waiter taking a customer’s order without writing anything down. If the customer asks for a complicated dish and the waiter mishears, the kitchen could end up serving something completely different—or worse, something harmful! The vulnerability exists because the 'SetLan' function does not properly sanitize input parameters when invoked via the management web request from 'index.cgi', allowing for command injection.

What to do

If exploited, an attacker could inject malicious commands directly into the system, potentially compromising control of the PLC devices. This could lead to catastrophic failures in industrial operations, causing downtime or even damage to physical equipment. Immediately patch to version 9.0.3 or later to remediate this vulnerability. Additionally, implement input validation and sanitization for all parameters in your web applications to prevent future exploits. You've got this! With the right steps, you'll ensure your systems are protected! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01269 · 69.6th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2025-12-02T18:15Z
Affected products (2)
ProductVersionsFixed in
circutor/sge-plc1000_firmwareall versions—
circutor/sge-plc50_firmwareall versions—
References (1)
EPSS history
Timeline
  • 02 DEC 12:57Z
    Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50
    cvelistv5