CVE-2025-11781

Katalog CVE

CVSS 7.8 · High EPSS 0,14%

Kerentanan Use of Hard-coded Cryptographic Key pada circutor sge-plc1000 firmware, circutor sge-plc50 firmware. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The affected firmware contains a hardcoded static authentication key. An attacker with local access to the device can extract this key (e.g., by analysing the firmware image or memory dump) and create valid firmware update packages. This bypasses all intended access controls and grants full administrative privileges.

Rincian

Terbit di NVD

2 Desember 2025

Terakhir diubah

26 September 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-321: Use of Hard-coded Cryptographic Key

EPSS (30 hari)

0,14% peluang dieksploitasi; lebih tinggi dari 2,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products-0 advisory pihak ketiga