HIGH🇵🇱 Wersja polska

CVE-2025-11781

CVSS 8.6v4.0pub. 2025-12-02upd. 2025-12-03

Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The affected firmware contains a hardcoded static authentication key. An attacker with local access to the device can extract this key (e.g., by analysing the firmware image or memory dump) and create valid firmware update packages. This bypasses all intended access controls and grants full administrative privileges.

CVSS Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Circutor Sge Plc1000

    HW
    Circutor
    all versions

  • Circutor Sge Plc1000 Firmware

    OS
    Circutor
    9.0.2

  • Circutor Sge Plc50

    HW
    Circutor
    all versions

  • Circutor Sge Plc50 Firmware

    OS
    Circutor
    9.0.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-11779CRITICAL9.4PL ✓same product

Stack-based buffer overflow w Circutor SGE-PLC1000/SGE-PLC50 via SetLan

CVE-2025-11778CRITICAL10.0PL ✓same product

Stack-based buffer overflow w Circutor SGE-PLC1000/SGE-PLC50 (TACACS+)

CVE-2021-33841CRITICAL10.0PL ✓same product

Command Injection w Circutor SGE-PLC1000 — zdalny dostęp z uprawnieniami root

CVE-2025-11780HIGH8.7same product

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'showMeterReport()'...

CVE-2025-11782HIGH8.5same product

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'ShowDownload()' funct...