Circutor
14 CVEs across 14 Circutor products. Browse Circutor vulnerabilities, severities, and proof-of-concept exploits.
Circutor products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11789 | High | 7.5 | 2025-12-02 | Out-of-bounds read vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'DownloadFile' function converts a parameter to an integer using 'atoi()' and th… |
CVE-2025-11788 | Critical | 9.8 | 2025-12-02 | Heap-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowSupervisorParameters()' function, there is an unlimited user inp… |
CVE-2025-11787 | High | 8.8 | 2025-12-02 | Command injection vulnerability in the operating system in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2 through the 'GetDNS()', 'CheckPing()' and 'TraceRoute()' funct… |
CVE-2025-11786 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'SetUserPassword()' function, the 'newPassword' parameter is directl… |
CVE-2025-11785 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowMeterPasswords()' function, there is an unlimited user input th… |
CVE-2025-11784 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowMeterDatabase()' function, there is an unlimited user input tha… |
CVE-2025-11783 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The vulnerability is found in the 'AddEvent()' function when copying the us… |
CVE-2025-11782 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'ShowDownload()' function uses “sprintf()” to format a string that incl… |
CVE-2025-11781 | High | 7.8 | 2025-12-02 | Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The affected firmware contains a hardcoded static authentication key. An attacker… |
CVE-2025-11780 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'showMeterReport()' function, there is an unlimited user input that… |
CVE-2025-11779 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in CircutorSGE-PLC1000/SGE-PLC50 v9.0.2. The 'SetLan' function is invoked when a new configuration is applied. This n… |
CVE-2025-11778 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow in Circutor SGE-PLC1000/SGE-PLC50 v0.9.2. This vulnerability allows an attacker to remotely exploit memory corruption through the '… |
CVE-2025-64389 | | 2025-10-31 | The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol. | |
CVE-2025-64388 | | 2025-10-31 | Denial of service of the web server through specific requests to this protocol | |
CVE-2025-64387 | | 2025-10-31 | The web application is vulnerable to a so-called ‘clickjacking’ attack. In this type of attack, the vulnerable page is inserted into a page controlled by the a… | |
CVE-2025-64385 | | 2025-10-31 | The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software. Using the manu… | |
CVE-2025-64386 | | 2025-10-31 | The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow… | |
CVE-2024-8891 | Medium | 5.3 | 2024-09-18 | An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it ind… |
CVE-2024-8892 | Medium | 5.3 | 2024-09-18 | Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/passw… |
CVE-2024-8890 | High | 8.0 | 2024-09-18 | An attacker with access to the network where the CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could obtain legitimate credentials or steal sessions… |
CVE-2024-8889 | Critical | 9.3 | 2024-09-18 | Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/passw… |
CVE-2024-8888 | Critical | 10.0 | 2024-09-18 | An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have… |
CVE-2024-8887 | Critical | 10.0 | 2024-09-18 | CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with access to the web service bypasses the… |
CVE-2022-1669 | Medium | 6.8 | 2022-05-24 | A buffer overflow vulnerability has been detected in the firewall function of the device management web portal. The device runs a CGI binary (index.cgi) to off… |
CVE-2021-26777 | Critical | 9.8 | 2021-12-02 | Buffer overflow vulnerability in function SetFirewall in index.cgi in CIRCUTOR COMPACT DC-S BASIC smart metering concentrator Firwmare version CIR_CDC_v1.2.17… |
CVE-2021-33842 | High | 8.8 | 2021-06-09 | Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an au… |
CVE-2021-33841 | Critical | 10.0 | 2021-06-09 | SGE-PLC1000 device, in its 0.9.2b firmware version, does not handle some requests correctly, allowing a remote attacker to inject code into the operating syste… |