CVE-2025-11786 is a critical flaw in SetUserPassword() in the Circutor SGE-PLC1000 and SGE-PLC50, firmware 9.0.2, scored 9.8 by NVD. Both models were discontinued in 2015, so no simple patch exists. INCIBE advises moving to the Compact DC or GEDE EDC line at version 2.0.0 or newer.
What's affected
The NVD record lists the Circutor SGE-PLC1000 and SGE-PLC50 and their firmware. The description names version 9.0.2 of the firmware as affected. The weakness sits in the function SetUserPassword(), which is part of the device's web management application.
These units act as a hub in a remote electricity network management system that uses the PRIME protocol. INCIBE coordinated the publication of twelve vulnerabilities in this product family, two critical and ten high. This post covers only CVE-2025-11786.
On fixed versions: the INCIBE notice does not describe a patch for the SGE series. It says the SGE-PLC100 and SGE-PLC50 units were discontinued in 2015 and replaced by the Compact DC, which itself became obsolete in November 2024. The current equivalent is the GEDE EDC. Circutor recommends updating Compact DC and GEDE EDC units to the latest available version, 2.0.4, or at a minimum 2.0.0. Read the full notice before you plan the work, because it is the source of truth.
How to check if you're exposed
There is no package manager command for this one, because it is embedded device firmware. Work from your asset records and the device itself.
- Search your inventory for the model names SGE-PLC1000 and SGE-PLC50. Older field deployments are often poorly documented, so also ask the teams that run metering infrastructure.
- Open the device's management interface from a trusted admin network and read the firmware version. The record names 9.0.2.
- Find out whether the management web interface is reachable from anywhere other than a dedicated management network. A scan of your own address ranges for the device's web port is a reasonable first step:
nmap -p 80,443 192.0.2.0/24(replace the range with your own). - Record every unit you find, its location, and who owns it. You will need this for the replacement plan.
The NVD vector is network based with no privileges and no user interaction, so reachability of the management interface decides how urgent this is.
What to do now
- Take the management interface off any network that is not a dedicated, access controlled management segment. If it faces the internet, fix that first.
- Put a firewall rule in front of each unit so only named admin hosts can reach the web interface.
- Plan replacement with a supported model. INCIBE names the Compact DC and the GEDE EDC, and says to use version 2.0.0 at least, with 2.0.4 the latest it lists.
- If replacement will take months, document the risk, monitor the segment for unexpected traffic to the device, and set a date to retire it.
- Check the INCIBE notice again before you finish, since the vendor guidance can change.
Why it matters
In SetUserPassword(), the NVD description says the newPassword parameter is placed into a shell command string with sprintf() without sanitising or validating it, and the string is then run with system(). That lets an attacker inject shell commands that run with the privileges of the application. The vector is network based, needs no login and no user interaction, and NVD scores it 9.8.
The class of weakness is 121 (stack-based buffer overflow). The record files this under the stack overflow weakness, but the description reads as command injection: user input becomes part of a command line. Both problems come from the same habit of building strings by hand around untrusted input. Passing arguments as a list to an exec style call, and validating the input, avoids the second one. Neither fix is expected for retired hardware, so network controls are your main defence.
Nothing in the record says this CVE is exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog. That is a reason to plan calmly, not a reason to leave an end of life device exposed.
Quick check
Is there a patch for CVE-2025-11786?
Not for the SGE-PLC1000 or SGE-PLC50 as far as the INCIBE notice says. The units were discontinued in 2015. The notice points to replacement models and tells you to run version 2.0.0 or newer on them. Check the notice for updates.
Does a firewall fix the problem?
It reduces who can reach the flaw, and for a device you cannot patch that matters a lot. It does not remove the flaw. Treat it as a stopgap while you replace the unit.
Sources
Last reviewed: 19 October 2026.
