CVE-2025-11788

CVE-2025-11788 is a critical heap-based buffer overflow vulnerability affecting Circutor SGE-PLC1000 and SGE-PLC50 devices running firmware v9.0.2. This flaw allows an unauthenticated attacker to provide unlimited input to the 'meter' parameter, which is then copied to a fixed-size buffer without validation, leading to a buffer overflow. With a CVSS score of 9.8 (Critical), this vulnerability presents a severe risk, enabling remote code execution, denial of service, and full compromise of affected systems. The attack requires no user interaction or privileges, making it easily exploitable over the network. While there is no evidence of active exploitation or publicly available exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 10 mentions, indicating awareness among security researchers.