High · published December 2, 2025
🚨 A hardcoded cryptographic key is hiding in plain sight in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2! This sneaky little flaw lets an attacker with local access just lift the key and bypass all security measures! 🔥 Think of it like a restaurant where the chef leaves the recipe for their special sauce out in the open. Anyone who finds it can whip up the dish without actually being part of the kitchen staff! If an attacker gets their hands on this hardcoded key, they can create malicious firmware updates that grant them full admin privileges! This is absolutely devastating, enabling them to control the device as if they were the rightful owner, compromising the entire system.
Think of it like a restaurant where the chef leaves the recipe for their special sauce out in the open. Anyone who finds it can whip up the dish without actually being part of the kitchen staff! This vulnerability allows attackers with local access to extract a hardcoded static authentication key from the firmware of the device. Once they have this key, they can create valid update packages, effectively bypassing all access controls.
If an attacker gets their hands on this hardcoded key, they can create malicious firmware updates that grant them full admin privileges! This is absolutely devastating, enabling them to control the device as if they were the rightful owner, compromising the entire system. To secure your devices, upgrade to the latest firmware version that removes the hardcoded key. Implement stricter access controls and consider conducting a thorough security audit of your devices. You've got this! Follow these steps and you'll keep your devices safe and sound! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| circutor/sge-plc1000_firmware | all versions | — |
| circutor/sge-plc50_firmware | all versions | — |