CVE-2025-11786
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-121
Desbordamiendo de búfer basado en pila (Stack)
Fecha de publicación:
02/12/2025
Última modificación:
02/12/2025
Descripción
*** Pendiente de traducción *** Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'SetUserPassword()' function, the 'newPassword' parameter is directly embedded in a shell command string using 'sprintf()' without any sanitisation or validation, and then executed using 'system()'. This allows an attacker to inject arbitrary shell commands that will be executed with the same privileges as the application.
Impacto
Puntuación base 4.0
8.50
Gravedad 4.0
ALTA