CVE-2025-11786

Name of the Vulnerable Software and Affected Versions Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2

Description A stack-based buffer overflow exists in the SetUserPassword() function. The newPassword parameter is incorporated into a shell command string using sprintf() without proper sanitisation or validation, and then executed using system(). This allows for the injection and execution of arbitrary shell commands with the same privileges as the application.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the SetUserPassword() function until a patch is available.