CVE-2025-11785 is a critical flaw in ShowMeterPasswords() in the Circutor SGE-PLC1000 and SGE-PLC50, firmware 9.0.2, scored 9.8 by NVD. Both models were discontinued in 2015, so no simple patch exists. INCIBE advises moving to the Compact DC or GEDE EDC line at version 2.0.0 or newer.
What's affected
The NVD record lists the Circutor SGE-PLC1000 and SGE-PLC50 and their firmware. The description names version 9.0.2 of the firmware as affected. The weakness sits in the function ShowMeterPasswords(), which is part of the device's web management application.
These units act as a hub in a remote electricity network management system that uses the PRIME protocol. INCIBE coordinated the publication of twelve vulnerabilities in this product family, two critical and ten high. This post covers only CVE-2025-11785.
On fixed versions: the INCIBE notice does not describe a patch for the SGE series. It says the SGE-PLC100 and SGE-PLC50 units were discontinued in 2015 and replaced by the Compact DC, which itself became obsolete in November 2024. The current equivalent is the GEDE EDC. Circutor recommends updating Compact DC and GEDE EDC units to the latest available version, 2.0.4, or at a minimum 2.0.0. Read the full notice before you plan the work, because it is the source of truth.
How to check if you're exposed
There is no package manager command for this one, because it is embedded device firmware. Work from your asset records and the device itself.
- Search your inventory for the model names SGE-PLC1000 and SGE-PLC50. Older field deployments are often poorly documented, so also ask the teams that run metering infrastructure.
- Open the device's management interface from a trusted admin network and read the firmware version. The record names 9.0.2.
- Find out whether the management web interface is reachable from anywhere other than a dedicated management network. A scan of your own address ranges for the device's web port is a reasonable first step:
nmap -p 80,443 192.0.2.0/24(replace the range with your own). - Record every unit you find, its location, and who owns it. You will need this for the replacement plan.
The NVD vector is network based with no privileges and no user interaction, so reachability of the management interface decides how urgent this is.
What to do now
- Take the management interface off any network that is not a dedicated, access controlled management segment. If it faces the internet, fix that first.
- Put a firewall rule in front of each unit so only named admin hosts can reach the web interface.
- Plan replacement with a supported model. INCIBE names the Compact DC and the GEDE EDC, and says to use version 2.0.0 at least, with 2.0.4 the latest it lists.
- If replacement will take months, document the risk, monitor the segment for unexpected traffic to the device, and set a date to retire it.
- Check the INCIBE notice again before you finish, since the vendor guidance can change.
Why it matters
In ShowMeterPasswords(), the NVD description says user input from the meter parameter is retrieved with GetParameter and copied into a fixed size buffer with sprintf(), with no check on its length. A caller who sends an excessively large value can write past the end of that buffer on the stack. The record's CVSS vector rates it 9.8, network reachable, no authentication, no user interaction.
The class of weakness is 121 (stack-based buffer overflow). Stack overflows in firmware are serious because small devices often lack the memory protections that desktop systems take for granted, and they rarely get patched. The fix in source terms is simple: check the length before copying, or use a bounded call such as snprintf(). Because the vendor has retired this hardware, that fix is unlikely to arrive, which is why the practical answer is replacement and isolation.
Nothing in the record says this CVE is exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog. That is a reason to plan calmly, not a reason to leave an end of life device exposed.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch for CVE-2025-11785?
Not for the SGE-PLC1000 or SGE-PLC50 as far as the INCIBE notice says. The units were discontinued in 2015. The notice points to replacement models and tells you to run version 2.0.0 or newer on them. Check the notice for updates.
Does a firewall fix the problem?
It reduces who can reach the flaw, and for a device you cannot patch that matters a lot. It does not remove the flaw. Treat it as a stopgap while you replace the unit.
Sources
Last reviewed: 19 October 2026.
