HIGH🇵🇱 Wersja polska

CVE-2025-11781

CVSS 8.6v4.0pub. 2025-12-02upd. 2025-12-03

Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The affected firmware contains a hardcoded static authentication key. An attacker with local access to the device can extract this key (e.g., by analysing the firmware image or memory dump) and create valid firmware update packages. This bypasses all intended access controls and grants full administrative privileges.

CVSS Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Circutor Sge Plc1000

    HW
    Circutor
    wszystkie wersje

  • Circutor Sge Plc1000 Firmware

    OS
    Circutor
    9.0.2

  • Circutor Sge Plc50

    HW
    Circutor
    wszystkie wersje

  • Circutor Sge Plc50 Firmware

    OS
    Circutor
    9.0.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-11779CRITICAL9.4PL ✓ten sam produkt

Stack-based buffer overflow w Circutor SGE-PLC1000/SGE-PLC50 via SetLan

CVE-2025-11778CRITICAL10.0PL ✓ten sam produkt

Stack-based buffer overflow w Circutor SGE-PLC1000/SGE-PLC50 (TACACS+)

CVE-2021-33841CRITICAL10.0ten sam produkt

SGE-PLC1000 device, in its 0.9.2b firmware version, does not handle some requests correctly, allowing a remote...

CVE-2025-11780HIGH8.7ten sam produkt

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'showMeterReport()'...

CVE-2025-11782HIGH8.5ten sam produkt

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'ShowDownload()' funct...