CVE-2025-11783

Critical

Published: 02 December 2025

Published

02 December 2025

Modified

03 December 2025

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0020 41.8th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-11783 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Circutor Sge-Plc1000 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

SI-2 requires timely identification, reporting, and correction of software flaws, directly mitigating this CVE by patching the buffer overflow in the AddEvent() function.

SI-10 Information Input Validation good match

prevent

SI-10 enforces information input validation at system entry points, preventing the stack-based buffer overflow by rejecting oversized user-controlled username inputs exceeding the 48-byte buffer.

SI-16 Memory Protection good match

prevent

SI-16 provides memory protection mechanisms such as ASLR and DEP, blocking successful exploitation of the buffer overflow for remote code execution despite memory corruption.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Unauthenticated remote buffer overflow leading to RCE on network-exposed PLC devices directly enables exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The vulnerability is found in the 'AddEvent()' function when copying the user-controlled username input to a fixed-size buffer (48 bytes) without boundary checking. This can lead to memory corruption, resulting in possible…

remote code execution.

Deeper analysisAI

CVE-2025-11783 is a stack-based buffer overflow vulnerability in Circutor SGE-PLC1000 and SGE-PLC50 devices running version 9.0.2. The flaw exists in the 'AddEvent()' function, which copies user-controlled username input into a fixed-size buffer of 48 bytes without boundary checking. This can cause memory corruption and potentially lead to remote code execution. The vulnerability is classified under CWE-121 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

A remote attacker requires no authentication or privileges and can exploit the vulnerability over the network with low attack complexity and no user interaction. By providing a maliciously crafted username input to the 'AddEvent()' function, the attacker triggers the buffer overflow, resulting in memory corruption. Successful exploitation enables remote code execution on the affected device, compromising confidentiality, integrity, and availability with high impact.

The INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products-0 details this and other vulnerabilities in Circutor products, including guidance on mitigation.