CVE-2025-11789

HIGH

Circutor Sge-plc1000 Firmware - Out-of-Bounds Read

Title source: rule
STIX 2.1

Description

Out-of-bounds read vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'DownloadFile' function converts a parameter to an integer using 'atoi()' and then uses it as an index in the 'FilesDownload' array with '(&FilesDownload)[iVar2]'. If the parameter is too large, it will access memory beyond the limits.

References (1)

Core 1

Scores

CVSS v3 7.5
EPSS 0.0003
EPSS Percentile 10.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-125
Status published
Products (2)
circutor/sge-plc1000_firmware 9.0.2
circutor/sge-plc50_firmware 9.0.2
Published Dec 02, 2025
Tracked Since Feb 18, 2026