Executive Summary

This vulnerability is an out-of-bounds read in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. It occurs in the 'DownloadFile' function, where a parameter is converted to an integer using 'atoi()' and then used as an index to access the 'FilesDownload' array. If the parameter value is too large, it causes the program to read memory beyond the array's limits, potentially leading to unexpected behavior or information disclosure.

Useful 0 Not Useful 0

Impact Analysis

The out-of-bounds read can lead to unauthorized access to memory areas beyond the intended array, which may result in information disclosure or cause the device to behave unpredictably. This can compromise the security and reliability of the affected Circutor devices, potentially impacting the management of electricity networks that rely on these devices.

Useful 0 Not Useful 0

Mitigation Strategies

The affected Circutor SGE-PLC1000/SGE-PLC50 devices are discontinued since 2015 and have been replaced by newer models. It is recommended to update the firmware to version 2.0.0 or later to mitigate this and related vulnerabilities. [1]

Useful 0 Not Useful 0