Filtered by vendor Circutor Subscriptions
Total 15 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-64386 1 Circutor 1 Tcprs1plus 2025-11-04 N/A
The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow an attacker with the token modify parameters of security, access or even steal the session without the legitimate and active session detecting it. The web server allows the attacker to reuse an old session JWT token while the legitimate session is active.
CVE-2025-64387 1 Circutor 1 Tcprs1plus 2025-11-04 N/A
The web application is vulnerable to a so-called ‘clickjacking’ attack. In this type of attack, the vulnerable page is inserted into a page controlled by the attacker in order to deceive the victim. This deception can range from making the victim click on a button to making them enter their login credentials in a form that, a priori, appears legitimate.
CVE-2025-64389 1 Circutor 1 Tcprs1plus 2025-11-04 N/A
The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol.
CVE-2025-64388 1 Circutor 1 Tcprs1plus 2025-11-04 N/A
Denial of service of the web server through specific requests to this protocol
CVE-2025-64385 1 Circutor 1 Tcprs1plus 2025-11-04 N/A
The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software. Using the manufacturer's software, the device can be configured via UDP. Analyzing this communication, it has been observed that any aspect of the initial configuration can be changed by means of the device's MAC without the need for authentication.
CVE-2022-1669 1 Circutor 2 Compact Dc-s Basic, Compact Dc-s Basic Firmware 2025-04-16 6.8 Medium
A buffer overflow vulnerability has been detected in the firewall function of the device management web portal. The device runs a CGI binary (index.cgi) to offer a management web application. Once authenticated with valid credentials in this web portal, a potential attacker could submit any "Address" value and it would be copied to a second variable with a "strcpy" vulnerable function without checking its length. Because of this, it is possible to send a long address value to overflow the process stack, controlling the function return address.
CVE-2021-33842 1 Circutor 2 Sge-plc1000, Sge-plc1000 Firmware 2024-11-21 8.8 High
Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device affected is located.
CVE-2021-33841 1 Circutor 2 Sge-plc1000, Sge-plc1000 Firmware 2024-11-21 10 Critical
SGE-PLC1000 device, in its 0.9.2b firmware version, does not handle some requests correctly, allowing a remote attacker to inject code into the operating system with maximum privileges.
CVE-2021-26777 1 Circutor 2 Compact Dc-s Basic, Compact Dc-s Basic Firmware 2024-11-21 9.8 Critical
Buffer overflow vulnerability in function SetFirewall in index.cgi in CIRCUTOR COMPACT DC-S BASIC smart metering concentrator Firwmare version CIR_CDC_v1.2.17, allows attackers to execute arbitrary code.
CVE-2024-8892 1 Circutor 2 Tcp2rs\+, Tcp2rs\+ Firmware 2024-10-07 5.3 Medium
Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/password authentication option enabled, without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use. This equipment is at the end of its useful life cycle.
CVE-2024-8889 1 Circutor 3 Circutor Tcp2rs Plus, Tcp2rs\+, Tcp2rs\+ Firmware 2024-10-07 9.3 Critical
Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/password authentication option enabled, without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use. This equipment is at the end of its useful life cycle.
CVE-2024-8888 1 Circutor 3 Circutor Q Smt, Q-smt, Q-smt Firmware 2024-10-01 10 Critical
An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc.
CVE-2024-8887 1 Circutor 3 Circutor Q Smt, Q-smt, Q-smt Firmware 2024-10-01 10 Critical
CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with access to the web service bypasses the authentication mechanisms on the login page, allowing the attacker to use all the functionalities implemented at web level that allow interacting with the device.
CVE-2024-8890 1 Circutor 2 Q-smt, Q-smt Firmware 2024-10-01 8 High
An attacker with access to the network where the CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could obtain legitimate credentials or steal sessions due to the fact that the device only implements the HTTP protocol. This fact prevents a secure communication channel from being established.
CVE-2024-8891 1 Circutor 3 Circutor Q Smt, Q-smt, Q-smt Firmware 2024-09-26 5.3 Medium
An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it indicates whether or not the user is present in CIRCUTOR Q-SMT in its firmware version 1.0.4.