CVE-2025-11789EPSS p16.4%
CVE-2025-11789CVE-2025-11789
circutor / sge-plc1000_firmware
Description
Out-of-bounds read vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'DownloadFile' function converts a parameter to an integer using 'atoi()' and then uses it as an index in the 'FilesDownload' array with '(&FilesDownload)[iVar2]'. If the parameter is too large, it will access memory beyond the limits.
Scoring
| CVSS | 7.5 () |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 0.26% probability of exploitation · percentile 16.4% · 2026-10-05T12:00:23Z |
| Last modified | 2026-09-25 |