CVE-2025-11788 is a critical flaw in ShowSupervisorParameters() in the Circutor SGE-PLC1000 and SGE-PLC50, firmware 9.0.2, scored 9.8 by NVD. Both models were discontinued in 2015, so no simple patch exists. INCIBE advises moving to the Compact DC or GEDE EDC line at version 2.0.0 or newer.
What's affected
The NVD record lists the Circutor SGE-PLC1000 and SGE-PLC50 and their firmware. The description names version 9.0.2 of the firmware as affected. The weakness sits in the function ShowSupervisorParameters(), which is part of the device's web management application.
These units act as a hub in a remote electricity network management system that uses the PRIME protocol. INCIBE coordinated the publication of twelve vulnerabilities in this product family, two critical and ten high. This post covers only CVE-2025-11788.
On fixed versions: the INCIBE notice does not describe a patch for the SGE series. It says the SGE-PLC100 and SGE-PLC50 units were discontinued in 2015 and replaced by the Compact DC, which itself became obsolete in November 2024. The current equivalent is the GEDE EDC. Circutor recommends updating Compact DC and GEDE EDC units to the latest available version, 2.0.4, or at a minimum 2.0.0. Read the full notice before you plan the work, because it is the source of truth.
How to check if you're exposed
There is no package manager command for this one, because it is embedded device firmware. Work from your asset records and the device itself.
- Search your inventory for the model names SGE-PLC1000 and SGE-PLC50. Older field deployments are often poorly documented, so also ask the teams that run metering infrastructure.
- Open the device's management interface from a trusted admin network and read the firmware version. The record names 9.0.2.
- Find out whether the management web interface is reachable from anywhere other than a dedicated management network. A scan of your own address ranges for the device's web port is a reasonable first step:
nmap -p 80,443 192.0.2.0/24(replace the range with your own). - Record every unit you find, its location, and who owns it. You will need this for the replacement plan.
The NVD vector is network based with no privileges and no user interaction, so reachability of the management interface decides how urgent this is.
What to do now
- Take the management interface off any network that is not a dedicated, access controlled management segment. If it faces the internet, fix that first.
- Put a firewall rule in front of each unit so only named admin hosts can reach the web interface.
- Plan replacement with a supported model. INCIBE names the Compact DC and the GEDE EDC, and says to use version 2.0.0 at least, with 2.0.4 the latest it lists.
- If replacement will take months, document the risk, monitor the segment for unexpected traffic to the device, and set a date to retire it.
- Check the INCIBE notice again before you finish, since the vendor guidance can change.
Why it matters
In ShowSupervisorParameters(), the NVD description says the same pattern appears as in related Circutor flaws. The meter parameter is read through GetParameter and written into a fixed size buffer with sprintf(), with no length validation. An oversized value overruns the buffer. NVD scores it 9.8 with a network vector, no privileges and no user interaction.
The class of weakness is 122 (heap-based buffer overflow). The record classes this as a heap overflow, where the earlier ones in the same notice are stack overflows. The distinction changes how an attacker would approach memory corruption, but the defender's view is the same: unvalidated length on attacker controlled input. The INCIBE notice lists many sibling issues in the same web application, so fixing one function in a patch would not have closed the family.
Nothing in the record says this CVE is exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog. That is a reason to plan calmly, not a reason to leave an end of life device exposed.
Quick check
Is there a patch for CVE-2025-11788?
Not for the SGE-PLC1000 or SGE-PLC50 as far as the INCIBE notice says. The units were discontinued in 2015. The notice points to replacement models and tells you to run version 2.0.0 or newer on them. Check the notice for updates.
Does a firewall fix the problem?
It reduces who can reach the flaw, and for a device you cannot patch that matters a lot. It does not remove the flaw. Treat it as a stopgap while you replace the unit.
Sources
Last reviewed: 19 October 2026.
