CVE-2025-11789
High · 7.5CVSS
7.5
EPSS
0.3%
Published
Dec 2, 2025
CISA due date
—
The record
Out-of-bounds read vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'DownloadFile' function converts a parameter to an integer using 'atoi()' and then uses it as an index in the 'FilesDownload' array with '(&FilesDownload)[iVar2]'. If the parameter is too large, it will access memory beyond the limits.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|