Circutor SGE-PLC1000/SGE-PLC50 Stack-Based Buffer Overflow Vulnerability

A stack-based buffer overflow vulnerability has been identified in Circutor SGE-PLC1000 and SGE-PLC50 devices, both running version 9.0.2. The vulnerability arises in the 'ShowMeterPasswords()' function, where user input is copied to a fixed-size buffer using 'sprintf()' without proper size validation. This flaw allows an attacker to exploit memory corruption by providing excessively large input for the 'meter' parameter.

Impact

Exploitation of this vulnerability leads to memory corruption, with potential consequences of remote code execution.

Remediation

Circutor SGE-PLC1000 and SGE-PLC50 units were discontinued in 2015. Users are advised to update to the latest available version (2.0.4) for the current equivalent product, the GEDE EDC. For units that were replaced by the Compact DC, which became obsolete in November 2024, it is recommended to update to the latest version available.