CVE-2025-11781 Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50
Attackers with local access can extract hardcoded keys to forge firmware updates, bypassing controls and gaining full administrative privileges on Circutor PLCs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-11781?
CVE-2025-11781 is a high-severity vulnerability in SGE-PLC1000 SGE-PLC50 Circutor, published on 2 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The affected firmware contains a hardcoded static authentication key. An attacker with local access to the device can extract this key (e.g., by analysing the firmware image or memory dump) and create valid firmware update packages. This bypasses all intended access controls and grants full administrative privileges.
Weakness: CWE-321
Which versions are affected by CVE-2025-11781?
It affects 2 products.
Products include Circutor Sge-Plc1000 Firmware, Circutor Sge-Plc50 Firmware.
How do I fix CVE-2025-11781?
No fix has been published for CVE-2025-11781 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-11781 being exploited?
There is no known exploitation of CVE-2025-11781 in the wild and no public exploit code.
Other vulnerabilities in SGE-PLC1000 SGE-PLC50 Circutor
- CVE-2025-11778 Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50
- CVE-2021-33841 Circutor SGE-PLC1000 OS command Injection
- CVE-2025-11779 Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50
- CVE-2021-33842 Circutor SGE-PLC1000 improper authentication
- CVE-2025-11780 Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50
Sources
Also known as GHSA-hrhq-7vp6-hj9f.