Circutor SGE-PLC1000/SGE-PLC50 Stack-Based Buffer Overflow Vulnerability Allowing Command Injection

A stack-based buffer overflow vulnerability has been identified in Circutor SGE-PLC1000 and SGE-PLC50 devices, both running version 9.0.2. The vulnerability arises in the 'SetLan' function, which is triggered when a new configuration is applied via a management web request. The 'index.cgi' web application does not properly sanitize the parameters, potentially leading to command injection.

Impact

Exploitation of this vulnerability allows for stack-based buffer overflow, which can commonly lead to memory corruption and arbitrary code execution.

Remediation

Circutor SGE-PLC1000 and SGE-PLC50 units were discontinued in 2015. Users are advised to update to the latest available version (2.0.4) or, at a minimum, to 2.0.0. For units replaced by the GEDE EDC, it is recommended to update to the latest version.