CVE-2025-11778

The error occurs in the 'read_packet()' function which is part of the TACACS+ protocol implementation on vulnerable devices. An attacker can remotely send a crafted network packet that causes a stack-based buffer overflow. Due to the lack of authentication requirements, attack complexity, or user interaction, the exploit can be performed over the network by any unauthorized person.

An attacker can remotely trigger memory corruption of the device, potentially leading to complete device takeover (RCE) or unavailability. Effects include both local systems and associated industrial systems (high impact on confidentiality, integrity, and availability).

Apply patches available from the manufacturer according to references. It is recommended to monitor manufacturer communications and the INCIBE-CERT page at: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products-0. Until updates are applied, consider isolating devices from external networks and restricting access to TACACS+ protocol using a firewall.

Circutor SGE-PLC1000 and Circutor SGE-PLC50 with firmware version v0.9.2