CVE-2021-33842 Circutor SGE-PLC1000 improper authentication
An attacker on the local network can bypass authentication via the cookie parameter to perform operations as an authenticated user on Circutor SGE-PLC1000 devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-33842?
CVE-2021-33842 is a high-severity authentication bypass vulnerability in Circutor SGE-PLC1000, published on 9 Jun 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device affected is located.
Weakness: CWE-565
Which versions are affected by CVE-2021-33842?
It affects 1 product.
Products include Circutor Sge-Plc1000 Firmware.
How do I fix CVE-2021-33842?
No fix has been published for CVE-2021-33842 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-33842 being exploited?
There is no known exploitation of CVE-2021-33842 in the wild and no public exploit code.
Other vulnerabilities in Circutor SGE-PLC1000
- CVE-2025-11778 Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50
- CVE-2021-33841 Circutor SGE-PLC1000 OS command Injection
- CVE-2025-11779 Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50
- CVE-2025-11780 Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50
- CVE-2025-11781 Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50
Sources
Also known as GHSA-vmhr-5qxj-xvcm.