{"id":"CVE-2025-11786","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-11786","generatedAt":"2026-10-28T01:13:11.759Z","title":"Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2.","description":"Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'SetUserPassword()' function, the 'newPassword' parameter is directly embedded in a shell command string using 'sprintf()' without any sanitisation or validation, and then executed using 'system()'. This allows an attacker to inject arbitrary shell commands that will be executed with the same privileges as the application.","published":"2025-12-02T13:15:50.000Z","lastModified":"2026-09-26T00:10:00.000Z","status":"Analyzed","sourceIdentifier":"cve-coordination@incibe.es","cvss":{"version":"4.0","score":8.5,"severity":"HIGH","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-121"],"affected":["circutor/sge-plc1000 firmware","circutor/sge-plc50 firmware"],"epss":{"score":0.00372,"percentile":0.30946,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products-0","tags":["Third Party Advisory"],"source":"cve-coordination@incibe.es"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-11786","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}