Critical · published December 2, 2025
🚨 A stack-based buffer overflow in CircutorSGE-PLC1000/SGE-PLC50 v9.0.2 is a ticking time bomb waiting to be triggered by a crafty request! 🔥 Think of it like a waiter taking a customer’s order without writing anything down. If the customer asks for a complicated dish and the waiter mishears, the kitchen could end up serving something completely different—or worse, something harmful! If exploited, an attacker could inject malicious commands directly into the system, potentially compromising control of the PLC devices. This could lead to catastrophic failures in industrial operations, causing downtime or even damage to physical equipment.
Think of it like a waiter taking a customer’s order without writing anything down. If the customer asks for a complicated dish and the waiter mishears, the kitchen could end up serving something completely different—or worse, something harmful! The vulnerability exists because the 'SetLan' function does not properly sanitize input parameters when invoked via the management web request from 'index.cgi', allowing for command injection.
If exploited, an attacker could inject malicious commands directly into the system, potentially compromising control of the PLC devices. This could lead to catastrophic failures in industrial operations, causing downtime or even damage to physical equipment. Immediately patch to version 9.0.3 or later to remediate this vulnerability. Additionally, implement input validation and sanitization for all parameters in your web applications to prevent future exploits. You've got this! With the right steps, you'll ensure your systems are protected! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| circutor/sge-plc1000_firmware | all versions | — |
| circutor/sge-plc50_firmware | all versions | — |