CVE-2025-11781

Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50

State: Published
Severity: 8.6 High
Published: Dec 2, 2025
Updated: Dec 2, 2025
Reserved: Oct 15, 2025

Description

Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The affected firmware contains a hardcoded static authentication key. An attacker with local access to the device can extract this key (e.g., by analysing the firmware image or memory dump) and create valid firmware update packages. This bypasses all intended access controls and grants full administrative privileges.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	INCIBE

Weaknesses

CWE-321 Use of Hard-coded Cryptographic Key

Affected Products

Product	Versions
CircutorSGE-PLC1000 SGE-PLC50	9.0.2Affected

References

https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products-0

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.