CVE-2021-33841 Circutor SGE-PLC1000 OS command Injection
Remote attackers can inject OS commands with maximum privileges on Circutor SGE-PLC1000 devices due to improper request handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-33841?
CVE-2021-33841 is a critical command injection vulnerability in Circutor SGE-PLC1000, published on 9 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SGE-PLC1000 device, in its 0.9.2b firmware version, does not handle some requests correctly, allowing a remote attacker to inject code into the operating system with maximum privileges.
Weakness: CWE-78
Which versions are affected by CVE-2021-33841?
It affects 1 product.
Products include Circutor Sge-Plc1000 Firmware.
How do I fix CVE-2021-33841?
No fix has been published for CVE-2021-33841 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-33841 being exploited?
There is no known exploitation of CVE-2021-33841 in the wild and no public exploit code.
Other vulnerabilities in Circutor SGE-PLC1000
- CVE-2025-11778 Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50
- CVE-2025-11779 Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50
- CVE-2021-33842 Circutor SGE-PLC1000 improper authentication
- CVE-2025-11780 Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50
- CVE-2025-11781 Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50
Sources
Also known as GHSA-56hw-2q6h-3vh6.