CVE-2025-11780: Circutor SGE-PLC Buffer Overflow Flaw

CVE-2025-11780 Overview

A stack-based buffer overflow vulnerability has been identified in Circutor SGE-PLC1000 and SGE-PLC50 firmware version 9.0.2. The vulnerability exists in the showMeterReport() function where unlimited user input is copied to a fixed-size buffer via sprintf(). The GetParameter(meter) function retrieves user input, which is directly incorporated into a buffer without any size validation. An attacker can exploit this flaw by providing an excessively large input for the "meter" parameter, potentially leading to arbitrary code execution or system compromise.

This vulnerability affects industrial programmable logic controllers (PLCs) used in critical infrastructure environments, making it a significant concern for operational technology (OT) security teams.

Critical Impact

Network-accessible stack-based buffer overflow in industrial PLC devices allows authenticated attackers to potentially execute arbitrary code, compromise device integrity, and disrupt industrial control systems with a CVSS 4.0 score of 8.7 (HIGH).

Affected Products

• Circutor SGE-PLC1000 Firmware version 9.0.2
• Circutor SGE-PLC1000 Hardware
• Circutor SGE-PLC50 Firmware version 9.0.2
• Circutor SGE-PLC50 Hardware

Discovery Timeline

• December 2, 2025 - CVE-2025-11780 published to NVD
• December 3, 2025 - Last updated in NVD database

Technical Details for CVE-2025-11780

Vulnerability Analysis

This vulnerability is classified as CWE-120 (Buffer Copy without Checking Size of Input), commonly known as a classic buffer overflow. The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N indicates:

• Attack Vector (AV:N): Network-accessible, meaning remote exploitation is possible
• Attack Complexity (AC:L): Low complexity, no specialized conditions required
• Privileges Required (PR:L): Low-level authentication is needed
• User Interaction (UI:N): No user interaction required for exploitation
• Impact: High confidentiality, integrity, and availability impact on the vulnerable system

The Exploit Prediction Scoring System (EPSS) indicates a probability of 0.047% with a percentile ranking of 14.712, suggesting relatively low current exploitation likelihood but significant potential impact given the critical infrastructure context.

Root Cause

The root cause stems from unsafe use of the sprintf() function in the showMeterReport() function. When processing the "meter" parameter, user-supplied input is retrieved via GetParameter(meter) and directly copied into a fixed-size stack buffer without any bounds checking or input length validation. This classic buffer overflow pattern allows attackers to overwrite adjacent stack memory, including return addresses and saved registers.

The absence of input sanitization and length verification before the sprintf() call creates a direct path for stack corruption when oversized input is provided.

Attack Vector

The attack can be executed remotely over the network by an authenticated attacker. The exploitation flow involves:

1. An attacker authenticates to the affected PLC device with low-privilege credentials
2. The attacker sends a specially crafted request to the vulnerable endpoint
3. The malicious request includes an excessively long value for the "meter" parameter
4. The showMeterReport() function processes the request and calls GetParameter(meter)
5. The oversized input is copied via sprintf() into the fixed-size stack buffer
6. Stack memory is corrupted, potentially allowing control flow hijacking

The vulnerability is exploitable through normal network interfaces exposed by the PLC device. For detailed technical information, refer to the INCIBE-CERT security advisory.

Detection Methods for CVE-2025-11780

Indicators of Compromise

• Anomalous network traffic containing unusually long parameter values targeting PLC web interfaces
• Unexpected device crashes, reboots, or firmware instability in Circutor SGE-PLC devices
• Unauthorized configuration changes or suspicious process behavior on affected PLCs
• Network requests with abnormally large "meter" parameter values in HTTP traffic logs

Detection Strategies

Organizations should implement the following detection approaches:

Network-Based Detection:

• Deploy intrusion detection systems (IDS) with rules to identify HTTP requests containing oversized parameter values
• Monitor for unusual traffic patterns to PLC management interfaces
• Implement deep packet inspection for traffic targeting Circutor device ports

Endpoint/Device Monitoring:

• Enable logging on PLC devices where available
• Monitor for unexpected device restarts or firmware anomalies
• Track authentication events and access patterns to PLC interfaces

SentinelOne Singularity Platform:
SentinelOne provides comprehensive protection for OT environments through its Singularity platform. The solution can detect exploitation attempts through behavioral analysis, identifying anomalous memory access patterns and buffer overflow exploitation techniques targeting connected industrial systems.

Monitoring Recommendations

Security teams should establish baseline behavior for PLC device communications and alert on deviations. Implement network segmentation monitoring to ensure OT networks remain isolated from untrusted networks. Consider deploying honeypot PLCs to detect active reconnaissance and exploitation attempts targeting industrial control systems.

Regular firmware integrity checks should be performed on affected devices to detect any unauthorized modifications resulting from successful exploitation.

How to Mitigate CVE-2025-11780

Immediate Actions Required

• Identify all Circutor SGE-PLC1000 and SGE-PLC50 devices running firmware version 9.0.2 in your environment
• Implement network segmentation to isolate affected PLCs from untrusted networks and the internet
• Apply strict firewall rules to limit access to PLC management interfaces to authorized personnel only
• Monitor affected devices for signs of exploitation or unusual behavior
• Review and restrict user accounts with access to affected PLC devices

Patch Information

Organizations should monitor Circutor for official firmware updates that address this vulnerability. Check the INCIBE-CERT advisory for updates on vendor response and patch availability.

Until an official patch is released, implementing defense-in-depth strategies and network controls is critical to reduce exploitation risk.

Workarounds

In the absence of an official patch, organizations should implement the following compensating controls:

• Network Isolation: Place affected PLCs on isolated network segments with no direct internet connectivity
• Access Control: Implement allowlist-based access control, permitting only authorized IP addresses to communicate with PLC interfaces
• VPN Requirements: Require VPN connections for any remote management of affected devices
• Input Filtering: Deploy a web application firewall (WAF) or reverse proxy in front of PLC web interfaces to filter and limit parameter lengths
• Monitoring: Implement enhanced logging and monitoring for all access to affected devices

These compensating controls should be maintained until Circutor releases an official security patch for the affected firmware versions.