CVE-2025-11789 Overview
CVE-2025-11789 is an out-of-bounds read vulnerability [CWE-125] affecting Circutor SGE-PLC1000 and SGE-PLC50 firmware version 9.0.2. The flaw resides in the DownloadFile function, which converts a user-supplied parameter to an integer using atoi() and uses the result as an index into the FilesDownload array via (&FilesDownload)[iVar2]. When the parameter exceeds the array bounds, the function reads memory outside the intended buffer. The vulnerability is network-reachable and requires only low-level authentication. Circutor SGE-PLC devices are power line communication gateways used in industrial and energy distribution environments, making this flaw relevant for operational technology (OT) defenders.
Critical Impact
An authenticated attacker can trigger an out-of-bounds read over the network, exposing memory contents from the affected Circutor SGE-PLC firmware and potentially destabilizing the device.
Affected Products
- Circutor SGE-PLC1000 firmware version 9.0.2
- Circutor SGE-PLC50 firmware version 9.0.2
- Circutor SGE-PLC1000 and SGE-PLC50 hardware running the affected firmware
Discovery Timeline
- 2025-12-02 - CVE-2025-11789 published to NVD
- 2025-12-03 - Last updated in NVD database
Technical Details for CVE-2025-11789
Vulnerability Analysis
The vulnerability is classified as an out-of-bounds read [CWE-125] in the DownloadFile function of the SGE-PLC1000 and SGE-PLC50 firmware. The function accepts a parameter from the request, converts it to a signed integer through atoi(), and dereferences (&FilesDownload)[iVar2] without validating that the index falls within the size of the FilesDownload array. Because atoi() does not signal errors and accepts arbitrarily large values, an attacker controls the index directly. The result is a read into memory outside the array, exposing adjacent process memory or causing a crash if the address is unmapped.
Root Cause
The root cause is missing bounds validation between the attacker-controlled input and the array dereference. The firmware trusts that the supplied parameter corresponds to a valid file slot. No upper-bound check, signed-value rejection, or range comparison is performed before the indexed read. Reliance on atoi() also prevents the code from distinguishing between malformed input and the value zero.
Attack Vector
Exploitation requires network access to the management interface of the SGE-PLC device and a valid low-privilege account. The attacker submits a crafted request to the DownloadFile endpoint with an oversized numeric parameter. The firmware evaluates (&FilesDownload)[iVar2] and reads memory beyond the array. Depending on the value supplied, the attacker can disclose memory contents in the response or trigger abnormal device behavior. Because the device performs control and telemetry functions in power line communication networks, unexpected reads can also affect availability of dependent industrial processes.
No public proof-of-concept is listed in the references for CVE-2025-11789. Technical details are available through the INCIBE Security Notice.
Detection Methods for CVE-2025-11789
Indicators of Compromise
- Requests to the DownloadFile endpoint on SGE-PLC1000 or SGE-PLC50 devices containing unusually large or non-numeric values for the file index parameter.
- Unexpected device reboots, watchdog resets, or process crashes on the affected firmware following management interface traffic.
- Authenticated sessions from low-privilege accounts issuing repeated file-download requests with varying index values.
Detection Strategies
- Inspect HTTP and management protocol logs from SGE-PLC devices for malformed parameters supplied to file download handlers.
- Compare normal DownloadFile parameter distributions against outliers using SIEM analytics to flag oversized integer values.
- Correlate authentication events with subsequent crashes or device restart events to identify exploitation attempts.
Monitoring Recommendations
- Forward Circutor SGE-PLC device logs and network captures from the OT management VLAN to a centralized SIEM for retention and search.
- Monitor uptime counters and process health metrics on the affected devices to detect availability impact from triggered reads.
- Alert on management interface access from any host that is not on the documented administrator allowlist.
How to Mitigate CVE-2025-11789
Immediate Actions Required
- Restrict network access to the SGE-PLC1000 and SGE-PLC50 management interfaces to a dedicated administrative network segment.
- Audit and remove unnecessary low-privilege accounts that can authenticate to the device web interface.
- Review device logs for prior DownloadFile requests carrying oversized or malformed integer parameters.
Patch Information
At the time of publication, no vendor patch URL is listed in the CVE record. Consult the INCIBE Security Notice for the latest vendor remediation guidance and contact Circutor directly to confirm firmware availability beyond version 9.0.2.
Workarounds
- Place the affected devices behind a firewall that permits management traffic only from known engineering workstations.
- Disable or remove device accounts that do not require file download privileges until a fixed firmware version is deployed.
- Apply network segmentation between IT and OT networks to limit the blast radius of authenticated access to industrial devices.
# Example firewall rule restricting management access to the SGE-PLC web interface
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
