CVE-2025-11789: Circutor Sge-PLC1000 Firmware
High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.
Out-of-bounds read vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'DownloadFile' function converts a parameter to an integer using 'atoi()' and then uses it as an index in the 'FilesDownload' array with '(&FilesDownload)[iVar2]'. If the parameter is too large, it will access memory beyond the limits.
Affected products
Published 2025-12-02. Last modified 2026-09-25.