CVE-2025-11779

The 'SetLan' function is called when applying new network configuration to the device. This configuration is initiated via an HTTP request to the 'index.cgi' web application, available to the logged-in user. The parameters passed to the function are not properly validated or sanitized, which enables injection of malicious data causing stack-based buffer overflow and potential execution of arbitrary commands.

An attacker with access to the local network and possessing basic user privileges can take control of the device by executing arbitrary system commands (command injection), which may result in complete device takeover and compromise of integrity, confidentiality and availability of both the device itself and systems connected to it.

Apply patches available from the manufacturer in accordance with the references (https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products-0). Until the fix is implemented, it is recommended to restrict access to the device's web interface only to trusted hosts and isolate devices in a dedicated segment of the industrial network.

Circutor SGE-PLC1000 and SGE-PLC50 devices with firmware version 9.0.2.