CVE-2025-11779 is a critical severity (NVD score 9.8) stack based buffer overflow in the Circutor SGE-PLC1000 and SGE-PLC50 data concentrators. Parameters to the SetLan function are not sanitised, which could also lead to command injection. The units are discontinued, so follow the vendor advice and upgrade or isolate them.
What's affected
The record lists the Circutor SGE-PLC1000 and SGE-PLC50, including their firmware. The INCIBE-CERT notice INCIBE-2025-0595, posted on 28 October 2025, names the affected resource as Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. It describes the devices as a modular hub that forms part of a remote electricity network management system using the PRIME protocol.
The record says the SetLan function is invoked when a new configuration is applied. That function is activated by a management web request, which a user can make through the index.cgi web application. The parameters are not being sanitised, which could lead to command injection. The weakness is classed under CWE-121 (Stack-based Buffer Overflow).
INCIBE coordinated the publication of 12 vulnerabilities in these devices, 2 critical and 10 high severity. This post covers one of them. The notice gives this item a CVSS v4.0 score of 9.4 (adjacent network vector), while the NVD record shows 9.8 under CVSS v3.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The notice credits the discovery to Gabriel Gonzalez and Sergio Ruiz.
How to check if you're exposed
Start by finding out whether you operate these concentrators. They sit in electricity metering and network management, so the owners are utilities, metering contractors, and energy service providers. Look in asset registers for the model names SGE-PLC1000 and SGE-PLC50.
Then read the firmware version on each unit. INCIBE says the oldest version still installed in the field is 1.0.14, and the latest version of these units is 1.2.21. The notice names v9.0.2 as the affected resource, so compare against both statements and ask Circutor to confirm the status of your specific build.
Check where the management web interface and the authentication service are reachable. The notice shows an adjacent network vector for this item, so the main concern is who shares a network segment with the device.
You can scan your asset list from a spreadsheet with a quick filter:
grep -iE "sge-plc(1000|50)" assets.csv
What to do now
-
Inventory every SGE-PLC1000 and SGE-PLC50 and record its firmware version and location.
-
Follow the vendor advice in the INCIBE notice. Circutor says the units were discontinued in 2015, were replaced by the Compact DC, which became obsolete in November 2024, and that the current equivalent is the GEDE EDC.
-
Circutor recommends updating the Compact DC and GEDE EDC units to the latest available version, 2.0.4, or at a minimum to 2.0.0.
-
Do not extend the useful life of the old concentrators without keeping them updated, as the vendor says.
-
Until replacement, isolate the devices on a dedicated management network, block access from user networks, and restrict the web interface to a small set of administrator hosts.
-
Monitor those hosts for crashes, restarts and unexpected configuration changes.
Why it matters
The record files this under CWE-121 (Stack-based Buffer Overflow). The common thread across this group is a length from the network that is copied into a buffer of fixed size. When the copy is not bounded, the program writes beyond the buffer, which can crash the service or corrupt memory in ways an attacker may steer.
The context is what raises the stakes. These devices are part of an electricity network management system, and equipment of that kind stays in service for many years. Devices that are 10 years past discontinuation are exactly where memory bugs persist. The practical defence is segmentation and replacement planning, since a patch for old hardware may never come.
The record does not mark the CVE as exploited in the CISA Known Exploited Vulnerabilities catalog, and the notice I fetched does not report exploitation.
Quick check
Is a fix available for the SGE-PLC units?
The vendor says the units were discontinued in 2015 and recommends moving to the current equivalent, the GEDE EDC, on version 2.0.4 or at least 2.0.0. Read the INCIBE-CERT notice and ask Circutor for the status of your units.
Why do the scores differ between INCIBE and NVD?
INCIBE uses CVSS v4.0 and lists 9.4 (adjacent network vector). The NVD record uses CVSS v3.1 and shows 9.8. Both agree the item is serious.
Sources
- CVE-2025-11779 on Safeguard Gold
- NVD record for CVE-2025-11779
- INCIBE-CERT notice INCIBE-2025-0595, multiple vulnerabilities in Circutor products
Last reviewed: 19 October 2026.
