A critical stack-based buffer overflow in Circutor SGE-PLC series devices poses a severe risk of remote code execution and system compromise.

This is a stack-based buffer overflow occurring in the showMeterReport() function. An unauthenticated attacker can supply an excessively large string to the 'meter' parameter, which is copied to a fixed-size buffer without length validation, leading to memory corruption.

The vulnerability carries a CVSS score of 9.8, indicating a critical risk to the confidentiality, integrity, and availability of the affected industrial controllers. Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the application, potentially leading to a total loss of control over the managed power infrastructure and significant operational downtime.

Immediate Action: Contact the vendor immediately to obtain the latest firmware update that addresses the lack of bounds checking in the showMeterReport() function.

Proactive Monitoring: Inspect network traffic for unusually large or malformed payloads directed at the device's management interface.

Compensating Controls: Implement strict network segmentation and firewall rules to restrict access to the device management interface to authorized IP addresses only.

Public Exploit Available: Unknown

Given the critical CVSS severity, immediate action is required to isolate these devices from untrusted networks. Administrators should prioritize applying vendor-supplied firmware patches as soon as they become available to prevent potential remote exploitation.