CVE-2025-11780: Circutor SGE-PLC Buffer Overflow Flaw

CVE-2025-11780 Overview

CVE-2025-11780 is a stack-based buffer overflow [CWE-120] affecting Circutor SGE-PLC1000 and SGE-PLC50 industrial power line communication devices running firmware version 9.0.2. The flaw resides in the showMeterReport() function, where the GetParameter(meter) call retrieves user-controlled input and passes it to sprintf() without size validation. An authenticated attacker can supply an oversized value for the meter parameter to overflow a fixed-size stack buffer. Successful exploitation can corrupt adjacent stack memory and lead to control-flow hijacking on the affected device.

Critical Impact
Network-reachable, low-privilege attackers can trigger a stack-based buffer overflow in Circutor SGE-PLC1000 and SGE-PLC50 firmware 9.0.2, threatening confidentiality, integrity, and availability of industrial control endpoints.

Affected Products

Circutor SGE-PLC1000 firmware 9.0.2
Circutor SGE-PLC50 firmware 9.0.2
Circutor SGE-PLC1000 and SGE-PLC50 hardware devices running the affected firmware

Discovery Timeline

2025-12-02 - CVE-2025-11780 published to NVD
2025-12-03 - Last updated in NVD database

Technical Details for CVE-2025-11780

Vulnerability Analysis

The vulnerability lives inside the showMeterReport() function in the web interface of the affected Circutor firmware. The function calls GetParameter(meter) to read the meter HTTP request parameter, then concatenates that value into a local stack buffer using sprintf(). Because sprintf() does not enforce a destination size limit, attacker-controlled input exceeding the buffer length writes beyond its bounds. The overflow corrupts adjacent stack data including saved return addresses and frame pointers. Industrial gateways such as SGE-PLC1000 and SGE-PLC50 typically lack modern exploitation mitigations, which increases the reliability of code execution after a successful overwrite.

Root Cause

The root cause is the unbounded copy of attacker-controlled input into a fixed-size stack buffer. The code path trusts the length of the meter parameter and never validates or truncates it before invoking sprintf(). This pattern is a textbook instance of [CWE-120] Buffer Copy without Checking Size of Input.

Attack Vector

Exploitation requires network access to the device web interface and low-privilege authenticated credentials. An attacker submits a crafted HTTP request to the endpoint that invokes showMeterReport(), providing an excessively long string for the meter parameter. The oversized input overflows the destination buffer, enabling stack corruption and potential arbitrary code execution under the privileges of the web service. Detailed technical analysis is available in the INCIBE Security Notice.

Detection Methods for CVE-2025-11780

Indicators of Compromise

HTTP POST or GET requests to the device management interface containing abnormally long meter parameter values.
Unexpected reboots, watchdog resets, or web service crashes on SGE-PLC1000 or SGE-PLC50 devices.
Authentication events from unusual source addresses immediately preceding malformed requests to meter reporting endpoints.

Detection Strategies

Inspect HTTP traffic to Circutor management interfaces and alert on meter parameter values exceeding a conservative length threshold.
Correlate web service restarts on the devices with preceding HTTP requests to identify exploitation attempts.
Deploy network signatures that match long alphanumeric or shellcode-like payloads in requests targeting the meter reporting endpoint.

Monitoring Recommendations

Forward device syslog and web application logs to a centralized SIEM for retention and correlation.
Baseline normal request sizes against the SGE-PLC web interface and alert on statistical outliers.
Monitor for new or unexpected authenticated sessions originating from outside the industrial control network segment.

How to Mitigate CVE-2025-11780

Immediate Actions Required

Restrict network access to the SGE-PLC1000 and SGE-PLC50 management interfaces to trusted engineering workstations only.
Rotate credentials used to authenticate to affected devices and remove unused accounts.
Place affected devices behind a firewall or VPN and block direct exposure from corporate or internet-facing networks.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Refer to the INCIBE Security Notice for vendor coordination details and apply any firmware updates Circutor releases for versions superseding 9.0.2.

Workarounds

Segment SGE-PLC1000 and SGE-PLC50 devices into an isolated OT VLAN with strict ingress filtering on the management port.
Disable or restrict access to the meter reporting web endpoint where operationally feasible.
Enforce network-level rate limiting and request size limits via an upstream reverse proxy to drop oversized meter parameter values.

bash

# Configuration example: drop oversized 'meter' parameters at an upstream proxy (nginx)
location / {
    if ($arg_meter ~* ".{256,}") {
        return 400;
    }
    proxy_pass http://sge-plc-device-internal;
}