CVE-2025-11783
Published: 02 December 2025
Summary
CVE-2025-11783 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Circutor Sge-Plc1000 Firmware. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-11783 is a stack-based buffer overflow vulnerability in Circutor SGE-PLC1000 and SGE-PLC50 devices running version 9.0.2. The flaw exists in the 'AddEvent()' function, which copies user-controlled username input into a fixed-size buffer of 48 bytes without boundary checking. This can cause memory corruption and potentially lead to remote code execution. The vulnerability is classified under CWE-121 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A remote attacker requires no authentication or privileges and can exploit the vulnerability over the network with low attack complexity and no user interaction. By providing a maliciously crafted username input to the 'AddEvent()' function, the attacker triggers the buffer overflow, resulting in memory corruption. Successful exploitation enables remote code execution on the affected device, compromising confidentiality, integrity, and availability with high impact.
The INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products-0 details this and other vulnerabilities in Circutor products, including guidance on mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-200233
- 🇪🇸 INCIBE: www.incibe.es
Vulnerability details
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The vulnerability is found in the 'AddEvent()' function when copying the user-controlled username input to a fixed-size buffer (48 bytes) without boundary checking. This can lead to memory corruption, resulting in possible…
more
remote code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote buffer overflow leading to RCE on network-exposed PLC devices directly enables exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely identification, reporting, and correction of software flaws, directly mitigating this CVE by patching the buffer overflow in the AddEvent() function.
SI-10 enforces information input validation at system entry points, preventing the stack-based buffer overflow by rejecting oversized user-controlled username inputs exceeding the 48-byte buffer.
SI-16 provides memory protection mechanisms such as ASLR and DEP, blocking successful exploitation of the buffer overflow for remote code execution despite memory corruption.