Search criteria
22 vulnerabilities found for Tellus Lite by Fuji Electric
VAR-202212-1812
Vulnerability from variot - Updated: 2025-12-19 22:49Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to execute arbitrary code. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of X1 files in the V-Simulator 6 application. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. It is primarily used to collect real-time data from devices such as PLCs (Programmable Logic Controllers), temperature controllers, and inverters
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202212-1812",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tellus lite v-simulator",
"scope": "lte",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.12.0"
},
{
"model": "tellus lite v-simulator",
"scope": "lte",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "4.0.12.0 and earlier"
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite",
"scope": null,
"trust": 0.7,
"vendor": "fuji electric",
"version": null
},
{
"model": "electric fuji electric tellus lite v-simulator",
"scope": "lte",
"trust": 0.6,
"vendor": "fuji",
"version": "\u003c=4.0.12.0"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-821"
},
{
"db": "CNVD",
"id": "CNVD-2025-24579"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-005820"
},
{
"db": "NVD",
"id": "CVE-2022-3085"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kimiya",
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-821"
}
],
"trust": 0.7
},
"cve": "CVE-2022-3085",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2025-24579",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2022-3085",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "OTHER",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2022-005820",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2022-3085",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-3085",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2022-3085",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "OTHER",
"id": "JVNDB-2022-005820",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2022-3085",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2025-24579",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202212-3658",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-821"
},
{
"db": "CNVD",
"id": "CNVD-2025-24579"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-3658"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-005820"
},
{
"db": "NVD",
"id": "CVE-2022-3085"
},
{
"db": "NVD",
"id": "CVE-2022-3085"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "\nFuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to execute arbitrary code. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of X1 files in the V-Simulator 6 application. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. It is primarily used to collect real-time data from devices such as PLCs (Programmable Logic Controllers), temperature controllers, and inverters",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-3085"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-005820"
},
{
"db": "ZDI",
"id": "ZDI-23-821"
},
{
"db": "CNVD",
"id": "CNVD-2025-24579"
},
{
"db": "VULMON",
"id": "CVE-2022-3085"
}
],
"trust": 2.88
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-3085",
"trust": 4.6
},
{
"db": "ICS CERT",
"id": "ICSA-22-354-01",
"trust": 2.5
},
{
"db": "JVN",
"id": "JVNVU90957471",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2022-005820",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-16717",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-821",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2025-24579",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.6634",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202212-3658",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2022-3085",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-821"
},
{
"db": "CNVD",
"id": "CNVD-2025-24579"
},
{
"db": "VULMON",
"id": "CVE-2022-3085"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-3658"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-005820"
},
{
"db": "NVD",
"id": "CVE-2022-3085"
}
]
},
"id": "VAR-202212-1812",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-24579"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-24579"
}
]
},
"last_update_date": "2025-12-19T22:49:46.010000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "top page",
"trust": 0.8,
"url": "https://www.fujielectric.co.jp/"
},
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-354-01"
},
{
"title": "Patch for Fuji Electric Tellus Lite V-Simulator Stack Buffer Overflow Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/744661"
},
{
"title": "Fuji Electric Tellus Lite V-Simulator Security vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=218425"
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/Live-Hack-CVE/CVE-2022-3085 "
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-821"
},
{
"db": "CNVD",
"id": "CNVD-2025-24579"
},
{
"db": "VULMON",
"id": "CVE-2022-3085"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-3658"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-005820"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-121",
"trust": 1.0
},
{
"problemtype": "Stack-based buffer overflow (CWE-121) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-005820"
},
{
"db": "NVD",
"id": "CVE-2022-3085"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-3085"
},
{
"trust": 1.7,
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-354-01"
},
{
"trust": 1.5,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-354-01"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu90957471/index.html"
},
{
"trust": 0.6,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-354-01"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-3085/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.6634"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/121.html"
},
{
"trust": 0.1,
"url": "https://github.com/live-hack-cve/cve-2022-3085"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-821"
},
{
"db": "CNVD",
"id": "CNVD-2025-24579"
},
{
"db": "VULMON",
"id": "CVE-2022-3085"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-3658"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-005820"
},
{
"db": "NVD",
"id": "CVE-2022-3085"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-23-821"
},
{
"db": "CNVD",
"id": "CNVD-2025-24579"
},
{
"db": "VULMON",
"id": "CVE-2022-3085"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-3658"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-005820"
},
{
"db": "NVD",
"id": "CVE-2022-3085"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-06-08T00:00:00",
"db": "ZDI",
"id": "ZDI-23-821"
},
{
"date": "2025-10-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-24579"
},
{
"date": "2023-01-19T00:00:00",
"db": "VULMON",
"id": "CVE-2022-3085"
},
{
"date": "2022-12-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202212-3658"
},
{
"date": "2023-06-14T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-005820"
},
{
"date": "2023-01-19T00:15:10.380000",
"db": "NVD",
"id": "CVE-2022-3085"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-06-08T00:00:00",
"db": "ZDI",
"id": "ZDI-23-821"
},
{
"date": "2025-11-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-24579"
},
{
"date": "2023-01-19T00:00:00",
"db": "VULMON",
"id": "CVE-2022-3085"
},
{
"date": "2023-01-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202212-3658"
},
{
"date": "2023-06-14T01:29:00",
"db": "JVNDB",
"id": "JVNDB-2022-005820"
},
{
"date": "2023-11-07T03:50:45.970000",
"db": "NVD",
"id": "CVE-2022-3085"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202212-3658"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji\u00a0Electric\u00a0Tellus\u00a0Lite\u00a0V-Simulator\u00a0 Stack-based buffer overflow vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-005820"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202212-3658"
}
],
"trust": 0.6
}
}
VAR-202311-1677
Vulnerability from variot - Updated: 2025-12-19 22:45A user with a standard account in Fuji Electric Tellus Lite may overwrite files in the system. Fuji Electric's Tellus Lite V-Simulator Exists in unspecified vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the product installer. The issue results from incorrect permissions set on product folders created by the installer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of any user of the software. It is primarily used to collect real-time data from devices such as PLCs (Programmable Logic Controllers), temperature controllers, and inverters. Detailed vulnerability information is not currently available
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202311-1677",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tellus lite v-simulator",
"scope": "lt",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.19.0"
},
{
"model": "tellus lite v-simulator",
"scope": null,
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "4.0.19.0"
},
{
"model": "tellus lite",
"scope": null,
"trust": 0.7,
"vendor": "fuji electric",
"version": null
},
{
"model": "electric fuji electric tellus lite v-simulator",
"scope": "lt",
"trust": 0.6,
"vendor": "fuji",
"version": "v4.0.19.0"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"db": "CNVD",
"id": "CNVD-2025-24578"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fritz Sands",
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1730"
}
],
"trust": 0.7
},
"cve": "CVE-2023-5299",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CNVD-2025-24578",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2023-5299",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ics-cert@hq.dhs.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.3,
"id": "CVE-2023-5299",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2023-5299",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.3,
"id": "CVE-2023-5299",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2023-5299",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2023-5299",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2023-5299",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2023-5299",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2025-24578",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"db": "CNVD",
"id": "CNVD-2025-24578"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"db": "NVD",
"id": "CVE-2023-5299"
},
{
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A user with a standard account in Fuji Electric Tellus Lite may overwrite files in the system. Fuji Electric\u0027s Tellus Lite V-Simulator Exists in unspecified vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the product installer. The issue results from incorrect permissions set on product folders created by the installer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of any user of the software. It is primarily used to collect real-time data from devices such as PLCs (Programmable Logic Controllers), temperature controllers, and inverters. Detailed vulnerability information is not currently available",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-5299"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"db": "CNVD",
"id": "CNVD-2025-24578"
},
{
"db": "VULMON",
"id": "CVE-2023-5299"
}
],
"trust": 2.88
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-5299",
"trust": 4.0
},
{
"db": "ICS CERT",
"id": "ICSA-23-325-02",
"trust": 2.5
},
{
"db": "JVN",
"id": "JVNVU98886797",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018322",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21224",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1730",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2025-24578",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2023-5299",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"db": "CNVD",
"id": "CNVD-2025-24578"
},
{
"db": "VULMON",
"id": "CVE-2023-5299"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"id": "VAR-202311-1677",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-24578"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-24578"
}
]
},
"last_update_date": "2025-12-19T22:45:54.874000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02"
},
{
"title": "Patch for Fuji Electric Tellus Lite V-Simulator Access Control Violation",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/744651"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"db": "CNVD",
"id": "CNVD-2025-24578"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-284",
"trust": 1.0
},
{
"problemtype": "others (CWE-Other) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02"
},
{
"trust": 1.9,
"url": "https://felib.fujielectric.co.jp/en/m10009/m20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98886797/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-5299"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"db": "CNVD",
"id": "CNVD-2025-24578"
},
{
"db": "VULMON",
"id": "CVE-2023-5299"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"db": "CNVD",
"id": "CNVD-2025-24578"
},
{
"db": "VULMON",
"id": "CVE-2023-5299"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"date": "2025-10-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-24578"
},
{
"date": "2023-11-22T00:00:00",
"db": "VULMON",
"id": "CVE-2023-5299"
},
{
"date": "2024-01-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"date": "2023-11-22T01:15:08.187000",
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"date": "2025-11-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-24578"
},
{
"date": "2023-11-22T00:00:00",
"db": "VULMON",
"id": "CVE-2023-5299"
},
{
"date": "2024-01-11T02:33:00",
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"date": "2024-09-04T19:35:10.513000",
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric\u0027s \u00a0Tellus\u00a0Lite\u00a0V-Simulator\u00a0 Vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-018322"
}
],
"trust": 0.8
}
}
VAR-202411-1725
Vulnerability from variot - Updated: 2025-10-17 22:50Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24769. (DoS) It may be in a state. It is primarily used to collect real-time data from devices such as PLCs, temperature controllers, and inverters. An attacker can exploit this vulnerability by submitting a specially crafted file request to trick the user into parsing the file, potentially causing the application to crash or executing arbitrary code within the application context
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202411-1725",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.20.0"
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "4.0.20.0"
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": null,
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite",
"scope": null,
"trust": 0.7,
"vendor": "fuji electric",
"version": null
},
{
"model": "electric tellus lite v-simulator",
"scope": "eq",
"trust": 0.6,
"vendor": "fuji",
"version": "5"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1627"
},
{
"db": "CNVD",
"id": "CNVD-2025-21317"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013909"
},
{
"db": "NVD",
"id": "CVE-2024-11801"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kimiya",
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1627"
}
],
"trust": 0.7
},
"cve": "CVE-2024-11801",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2025-21317",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-11801",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-11801",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-11801",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2024-11801",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2024-11801",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2024-11801",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2024-11801",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2025-21317",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1627"
},
{
"db": "CNVD",
"id": "CNVD-2025-21317"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013909"
},
{
"db": "NVD",
"id": "CVE-2024-11801"
},
{
"db": "NVD",
"id": "CVE-2024-11801"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. \n\nThe specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24769. (DoS) It may be in a state. It is primarily used to collect real-time data from devices such as PLCs, temperature controllers, and inverters. An attacker can exploit this vulnerability by submitting a specially crafted file request to trick the user into parsing the file, potentially causing the application to crash or executing arbitrary code within the application context",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-11801"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013909"
},
{
"db": "ZDI",
"id": "ZDI-24-1627"
},
{
"db": "CNVD",
"id": "CNVD-2025-21317"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-11801",
"trust": 3.9
},
{
"db": "ZDI",
"id": "ZDI-24-1627",
"trust": 3.1
},
{
"db": "ICS CERT",
"id": "ICSA-24-338-06",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU98326656",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013909",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-24769",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2025-21317",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1627"
},
{
"db": "CNVD",
"id": "CNVD-2025-21317"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013909"
},
{
"db": "NVD",
"id": "CVE-2024-11801"
}
]
},
"id": "VAR-202411-1725",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-21317"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-21317"
}
]
},
"last_update_date": "2025-10-17T22:50:19.073000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "Out-of-bounds writing (CWE-787) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-013909"
},
{
"db": "NVD",
"id": "CVE-2024-11801"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.zerodayinitiative.com/advisories/zdi-24-1627/"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98326656/index.html"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-11801"
},
{
"trust": 0.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-06"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-21317"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013909"
},
{
"db": "NVD",
"id": "CVE-2024-11801"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-24-1627"
},
{
"db": "CNVD",
"id": "CNVD-2025-21317"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013909"
},
{
"db": "NVD",
"id": "CVE-2024-11801"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-24-1627"
},
{
"date": "2025-09-15T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-21317"
},
{
"date": "2024-12-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-013909"
},
{
"date": "2024-11-28T00:15:05.873000",
"db": "NVD",
"id": "CVE-2024-11801"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-24-1627"
},
{
"date": "2025-09-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-21317"
},
{
"date": "2024-12-05T07:26:00",
"db": "JVNDB",
"id": "JVNDB-2024-013909"
},
{
"date": "2024-12-03T16:22:22.837000",
"db": "NVD",
"id": "CVE-2024-11801"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric\u0027s \u00a0Tellus\u00a0Lite\u00a0V-Simulator\u00a0 Out-of-bounds write vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-013909"
}
],
"trust": 0.8
}
}
VAR-202411-1620
Vulnerability from variot - Updated: 2025-10-17 22:50Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24770. Fuji Electric's Tellus Lite V-Simulator Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. It is primarily used to collect real-time data from devices such as PLCs, temperature controllers, and inverters. An attacker can exploit this vulnerability by submitting a specially crafted file request to trick the user into parsing the file, potentially causing the application to crash or executing arbitrary code within the application context
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202411-1620",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.20.0"
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "4.0.20.0"
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": null,
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite",
"scope": null,
"trust": 0.7,
"vendor": "fuji electric",
"version": null
},
{
"model": "electric tellus lite v-simulator",
"scope": "eq",
"trust": 0.6,
"vendor": "fuji",
"version": "5"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1628"
},
{
"db": "CNVD",
"id": "CNVD-2025-21318"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013926"
},
{
"db": "NVD",
"id": "CVE-2024-11802"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kimiya",
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1628"
}
],
"trust": 0.7
},
"cve": "CVE-2024-11802",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2025-21318",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-11802",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-11802",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-11802",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2024-11802",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2024-11802",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2024-11802",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2024-11802",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2025-21318",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1628"
},
{
"db": "CNVD",
"id": "CNVD-2025-21318"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013926"
},
{
"db": "NVD",
"id": "CVE-2024-11802"
},
{
"db": "NVD",
"id": "CVE-2024-11802"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. \n\nThe specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24770. Fuji Electric\u0027s Tellus Lite V-Simulator Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. It is primarily used to collect real-time data from devices such as PLCs, temperature controllers, and inverters. An attacker can exploit this vulnerability by submitting a specially crafted file request to trick the user into parsing the file, potentially causing the application to crash or executing arbitrary code within the application context",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-11802"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013926"
},
{
"db": "ZDI",
"id": "ZDI-24-1628"
},
{
"db": "CNVD",
"id": "CNVD-2025-21318"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-11802",
"trust": 3.9
},
{
"db": "ZDI",
"id": "ZDI-24-1628",
"trust": 3.1
},
{
"db": "ICS CERT",
"id": "ICSA-24-338-06",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU98326656",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013926",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-24770",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2025-21318",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1628"
},
{
"db": "CNVD",
"id": "CNVD-2025-21318"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013926"
},
{
"db": "NVD",
"id": "CVE-2024-11802"
}
]
},
"id": "VAR-202411-1620",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-21318"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-21318"
}
]
},
"last_update_date": "2025-10-17T22:50:19.018000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "CWE-121",
"trust": 1.0
},
{
"problemtype": "Stack-based buffer overflow (CWE-121) [ others ]",
"trust": 0.8
},
{
"problemtype": " Out-of-bounds writing (CWE-787) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-013926"
},
{
"db": "NVD",
"id": "CVE-2024-11802"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.zerodayinitiative.com/advisories/zdi-24-1628/"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98326656/index.html"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-11802"
},
{
"trust": 0.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-06"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-21318"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013926"
},
{
"db": "NVD",
"id": "CVE-2024-11802"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-24-1628"
},
{
"db": "CNVD",
"id": "CNVD-2025-21318"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013926"
},
{
"db": "NVD",
"id": "CVE-2024-11802"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-24-1628"
},
{
"date": "2025-09-15T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-21318"
},
{
"date": "2024-12-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-013926"
},
{
"date": "2024-11-28T00:15:06.007000",
"db": "NVD",
"id": "CVE-2024-11802"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-24-1628"
},
{
"date": "2025-09-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-21318"
},
{
"date": "2024-12-05T07:26:00",
"db": "JVNDB",
"id": "JVNDB-2024-013926"
},
{
"date": "2024-12-03T16:16:58.833000",
"db": "NVD",
"id": "CVE-2024-11802"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric\u0027s \u00a0Tellus\u00a0Lite\u00a0V-Simulator\u00a0 Out-of-bounds write vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-013926"
}
],
"trust": 0.8
}
}
VAR-202411-1649
Vulnerability from variot - Updated: 2025-10-16 23:21Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24664. Fuji Electric's Tellus Lite V-Simulator Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. It is primarily used to collect real-time data from devices such as PLCs, temperature controllers, and inverters. An attacker can exploit this vulnerability by submitting a specially crafted file request to trick the user into parsing the file, potentially causing the application to crash or executing arbitrary code within the application context
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202411-1649",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.20.0"
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "4.0.20.0"
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": null,
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite",
"scope": null,
"trust": 0.7,
"vendor": "fuji electric",
"version": null
},
{
"model": "electric tellus lite v-simulator",
"scope": "eq",
"trust": 0.6,
"vendor": "fuji",
"version": "5"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1625"
},
{
"db": "CNVD",
"id": "CNVD-2025-21315"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013876"
},
{
"db": "NVD",
"id": "CVE-2024-11799"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kimiya",
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1625"
}
],
"trust": 0.7
},
"cve": "CVE-2024-11799",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2025-21315",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-11799",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-11799",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-11799",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2024-11799",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2024-11799",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2024-11799",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2024-11799",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2025-21315",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1625"
},
{
"db": "CNVD",
"id": "CNVD-2025-21315"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013876"
},
{
"db": "NVD",
"id": "CVE-2024-11799"
},
{
"db": "NVD",
"id": "CVE-2024-11799"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. \n\nThe specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24664. Fuji Electric\u0027s Tellus Lite V-Simulator Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. It is primarily used to collect real-time data from devices such as PLCs, temperature controllers, and inverters. An attacker can exploit this vulnerability by submitting a specially crafted file request to trick the user into parsing the file, potentially causing the application to crash or executing arbitrary code within the application context",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-11799"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013876"
},
{
"db": "ZDI",
"id": "ZDI-24-1625"
},
{
"db": "CNVD",
"id": "CNVD-2025-21315"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-11799",
"trust": 3.9
},
{
"db": "ZDI",
"id": "ZDI-24-1625",
"trust": 3.1
},
{
"db": "ICS CERT",
"id": "ICSA-24-338-06",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU98326656",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013876",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-24664",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2025-21315",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1625"
},
{
"db": "CNVD",
"id": "CNVD-2025-21315"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013876"
},
{
"db": "NVD",
"id": "CVE-2024-11799"
}
]
},
"id": "VAR-202411-1649",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-21315"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-21315"
}
]
},
"last_update_date": "2025-10-16T23:21:32.107000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "CWE-121",
"trust": 1.0
},
{
"problemtype": "Stack-based buffer overflow (CWE-121) [ others ]",
"trust": 0.8
},
{
"problemtype": " Out-of-bounds writing (CWE-787) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-013876"
},
{
"db": "NVD",
"id": "CVE-2024-11799"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.zerodayinitiative.com/advisories/zdi-24-1625/"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98326656/index.html"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-11799"
},
{
"trust": 0.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-06"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-21315"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013876"
},
{
"db": "NVD",
"id": "CVE-2024-11799"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-24-1625"
},
{
"db": "CNVD",
"id": "CNVD-2025-21315"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013876"
},
{
"db": "NVD",
"id": "CVE-2024-11799"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-24-1625"
},
{
"date": "2025-09-15T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-21315"
},
{
"date": "2024-12-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-013876"
},
{
"date": "2024-11-28T00:15:05.603000",
"db": "NVD",
"id": "CVE-2024-11799"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-24-1625"
},
{
"date": "2025-09-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-21315"
},
{
"date": "2024-12-05T07:26:00",
"db": "JVNDB",
"id": "JVNDB-2024-013876"
},
{
"date": "2024-12-03T16:22:54.423000",
"db": "NVD",
"id": "CVE-2024-11799"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric\u0027s \u00a0Tellus\u00a0Lite\u00a0V-Simulator\u00a0 Out-of-bounds write vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-013876"
}
],
"trust": 0.8
}
}
VAR-202411-1638
Vulnerability from variot - Updated: 2025-10-16 23:21Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24768. Fuji Electric's Tellus Lite V-Simulator Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. It is primarily used to collect real-time data from devices such as PLCs, temperature controllers, and inverters. An attacker can exploit this vulnerability by submitting a specially crafted file request to trick the user into parsing the file, potentially causing the application to crash or executing arbitrary code within the application context
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202411-1638",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.20.0"
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "4.0.20.0"
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": null,
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite",
"scope": null,
"trust": 0.7,
"vendor": "fuji electric",
"version": null
},
{
"model": "electric tellus lite v-simulator",
"scope": "eq",
"trust": 0.6,
"vendor": "fuji",
"version": "5"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1626"
},
{
"db": "CNVD",
"id": "CNVD-2025-21316"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013927"
},
{
"db": "NVD",
"id": "CVE-2024-11800"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kimiya",
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1626"
}
],
"trust": 0.7
},
"cve": "CVE-2024-11800",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2025-21316",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-11800",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-11800",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-11800",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2024-11800",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2024-11800",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2024-11800",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2024-11800",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2025-21316",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1626"
},
{
"db": "CNVD",
"id": "CNVD-2025-21316"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013927"
},
{
"db": "NVD",
"id": "CVE-2024-11800"
},
{
"db": "NVD",
"id": "CVE-2024-11800"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. \n\nThe specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24768. Fuji Electric\u0027s Tellus Lite V-Simulator Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. It is primarily used to collect real-time data from devices such as PLCs, temperature controllers, and inverters. An attacker can exploit this vulnerability by submitting a specially crafted file request to trick the user into parsing the file, potentially causing the application to crash or executing arbitrary code within the application context",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-11800"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013927"
},
{
"db": "ZDI",
"id": "ZDI-24-1626"
},
{
"db": "CNVD",
"id": "CNVD-2025-21316"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-11800",
"trust": 3.9
},
{
"db": "ZDI",
"id": "ZDI-24-1626",
"trust": 3.1
},
{
"db": "ICS CERT",
"id": "ICSA-24-338-06",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU98326656",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013927",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-24768",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2025-21316",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1626"
},
{
"db": "CNVD",
"id": "CNVD-2025-21316"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013927"
},
{
"db": "NVD",
"id": "CVE-2024-11800"
}
]
},
"id": "VAR-202411-1638",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-21316"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-21316"
}
]
},
"last_update_date": "2025-10-16T23:21:31.973000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "CWE-121",
"trust": 1.0
},
{
"problemtype": "Stack-based buffer overflow (CWE-121) [ others ]",
"trust": 0.8
},
{
"problemtype": " Out-of-bounds writing (CWE-787) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-013927"
},
{
"db": "NVD",
"id": "CVE-2024-11800"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.zerodayinitiative.com/advisories/zdi-24-1626/"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98326656/index.html"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-11800"
},
{
"trust": 0.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-06"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-21316"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013927"
},
{
"db": "NVD",
"id": "CVE-2024-11800"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-24-1626"
},
{
"db": "CNVD",
"id": "CNVD-2025-21316"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013927"
},
{
"db": "NVD",
"id": "CVE-2024-11800"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-24-1626"
},
{
"date": "2025-09-15T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-21316"
},
{
"date": "2024-12-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-013927"
},
{
"date": "2024-11-28T00:15:05.747000",
"db": "NVD",
"id": "CVE-2024-11800"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-24-1626"
},
{
"date": "2025-09-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-21316"
},
{
"date": "2024-12-05T07:26:00",
"db": "JVNDB",
"id": "JVNDB-2024-013927"
},
{
"date": "2024-12-03T16:22:41.957000",
"db": "NVD",
"id": "CVE-2024-11800"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric\u0027s \u00a0Tellus\u00a0Lite\u00a0V-Simulator\u00a0 Out-of-bounds write vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-013927"
}
],
"trust": 0.8
}
}
VAR-202411-1660
Vulnerability from variot - Updated: 2024-12-11 19:24Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24771. (DoS) It may be in a state
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202411-1660",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.20.0"
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "4.0.20.0"
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": null,
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite",
"scope": null,
"trust": 0.7,
"vendor": "fuji electric",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1629"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013908"
},
{
"db": "NVD",
"id": "CVE-2024-11803"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kimiya",
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1629"
}
],
"trust": 0.7
},
"cve": "CVE-2024-11803",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-11803",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-11803",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-11803",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2024-11803",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2024-11803",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2024-11803",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2024-11803",
"trust": 0.7,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1629"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013908"
},
{
"db": "NVD",
"id": "CVE-2024-11803"
},
{
"db": "NVD",
"id": "CVE-2024-11803"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. \n\nThe specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24771. (DoS) It may be in a state",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-11803"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013908"
},
{
"db": "ZDI",
"id": "ZDI-24-1629"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-11803",
"trust": 3.3
},
{
"db": "ZDI",
"id": "ZDI-24-1629",
"trust": 2.5
},
{
"db": "ICS CERT",
"id": "ICSA-24-338-06",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU98326656",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013908",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-24771",
"trust": 0.7
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-1629"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013908"
},
{
"db": "NVD",
"id": "CVE-2024-11803"
}
]
},
"id": "VAR-202411-1660",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 1.0
},
"last_update_date": "2024-12-11T19:24:40.106000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "Out-of-bounds writing (CWE-787) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-013908"
},
{
"db": "NVD",
"id": "CVE-2024-11803"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "https://www.zerodayinitiative.com/advisories/zdi-24-1629/"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98326656/index.html"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-11803"
},
{
"trust": 0.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-06"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-013908"
},
{
"db": "NVD",
"id": "CVE-2024-11803"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-24-1629"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-013908"
},
{
"db": "NVD",
"id": "CVE-2024-11803"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-24-1629"
},
{
"date": "2024-12-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-013908"
},
{
"date": "2024-11-28T00:15:06.143000",
"db": "NVD",
"id": "CVE-2024-11803"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-24-1629"
},
{
"date": "2024-12-05T07:26:00",
"db": "JVNDB",
"id": "JVNDB-2024-013908"
},
{
"date": "2024-12-03T16:16:42.027000",
"db": "NVD",
"id": "CVE-2024-11803"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric\u0027s \u00a0Tellus\u00a0Lite\u00a0V-Simulator\u00a0 Out-of-bounds write vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-013908"
}
],
"trust": 0.8
}
}
VAR-202406-0373
Vulnerability from variot - Updated: 2024-10-05 21:06Fuji Electric Tellus Lite V-Simulator is vulnerable to an out-of-bounds write, which could allow an attacker to manipulate memory, resulting in execution of arbitrary code. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of X1 files by the V-Simulator 6 module. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202406-0373",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tellus lite v-simulator",
"scope": "lt",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.20.0"
},
{
"model": "tellus lite v-simulator",
"scope": null,
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "4.0.20.0"
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite",
"scope": null,
"trust": 0.7,
"vendor": "fuji electric",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-678"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009715"
},
{
"db": "NVD",
"id": "CVE-2024-37022"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kimiya",
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-678"
}
],
"trust": 0.7
},
"cve": "CVE-2024-37022",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-37022",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ics-cert@hq.dhs.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-37022",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2024-37022",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-37022",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2024-37022",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2024-37022",
"trust": 1.0,
"value": "High"
},
{
"author": "NVD",
"id": "CVE-2024-37022",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2024-37022",
"trust": 0.7,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-678"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009715"
},
{
"db": "NVD",
"id": "CVE-2024-37022"
},
{
"db": "NVD",
"id": "CVE-2024-37022"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Tellus Lite V-Simulator is vulnerable to an out-of-bounds write, which could allow an attacker to manipulate memory, resulting in execution of arbitrary code. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of X1 files by the V-Simulator 6 module. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-37022"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009715"
},
{
"db": "ZDI",
"id": "ZDI-24-678"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-37022",
"trust": 3.3
},
{
"db": "ICS CERT",
"id": "ICSA-24-165-14",
"trust": 1.8
},
{
"db": "JVN",
"id": "JVNVU96920775",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009715",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-22746",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-678",
"trust": 0.7
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-678"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009715"
},
{
"db": "NVD",
"id": "CVE-2024-37022"
}
]
},
"id": "VAR-202406-0373",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 1.0
},
"last_update_date": "2024-10-05T21:06:53.091000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-14"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-678"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "Out-of-bounds writing (CWE-787) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009715"
},
{
"db": "NVD",
"id": "CVE-2024-37022"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-14"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu96920775/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-37022"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-678"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009715"
},
{
"db": "NVD",
"id": "CVE-2024-37022"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-24-678"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009715"
},
{
"db": "NVD",
"id": "CVE-2024-37022"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-06-13T00:00:00",
"db": "ZDI",
"id": "ZDI-24-678"
},
{
"date": "2024-10-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-009715"
},
{
"date": "2024-06-13T18:15:10.547000",
"db": "NVD",
"id": "CVE-2024-37022"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-678"
},
{
"date": "2024-10-04T05:18:00",
"db": "JVNDB",
"id": "JVNDB-2024-009715"
},
{
"date": "2024-10-03T15:55:56.250000",
"db": "NVD",
"id": "CVE-2024-37022"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric\u0027s \u00a0Tellus\u00a0Lite\u00a0V-Simulator\u00a0 Out-of-bounds write vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009715"
}
],
"trust": 0.8
}
}
VAR-202406-0374
Vulnerability from variot - Updated: 2024-10-05 19:42Fuji Electric Tellus Lite V-Simulator is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of V9 files by the V-Simulator 6 module. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202406-0374",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tellus lite",
"scope": null,
"trust": 2.1,
"vendor": "fuji electric",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "lt",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.20.0"
},
{
"model": "tellus lite v-simulator",
"scope": null,
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "4.0.20.0"
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-681"
},
{
"db": "ZDI",
"id": "ZDI-24-680"
},
{
"db": "ZDI",
"id": "ZDI-24-679"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009680"
},
{
"db": "NVD",
"id": "CVE-2024-37029"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kimiya",
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-681"
},
{
"db": "ZDI",
"id": "ZDI-24-680"
},
{
"db": "ZDI",
"id": "ZDI-24-679"
}
],
"trust": 2.1
},
"cve": "CVE-2024-37029",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-37029",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.1,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-37029",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ics-cert@hq.dhs.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-37029",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2024-37029",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "ZDI",
"id": "CVE-2024-37029",
"trust": 2.1,
"value": "HIGH"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2024-37029",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2024-37029",
"trust": 1.0,
"value": "High"
},
{
"author": "NVD",
"id": "CVE-2024-37029",
"trust": 0.8,
"value": "High"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-681"
},
{
"db": "ZDI",
"id": "ZDI-24-680"
},
{
"db": "ZDI",
"id": "ZDI-24-679"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009680"
},
{
"db": "NVD",
"id": "CVE-2024-37029"
},
{
"db": "NVD",
"id": "CVE-2024-37029"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Tellus Lite V-Simulator \nis vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of V9 files by the V-Simulator 6 module. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-37029"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009680"
},
{
"db": "ZDI",
"id": "ZDI-24-681"
},
{
"db": "ZDI",
"id": "ZDI-24-680"
},
{
"db": "ZDI",
"id": "ZDI-24-679"
}
],
"trust": 3.51
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-37029",
"trust": 4.7
},
{
"db": "ICS CERT",
"id": "ICSA-24-165-14",
"trust": 1.8
},
{
"db": "JVN",
"id": "JVNVU96920775",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009680",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-22747",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-681",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-22813",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-680",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-22875",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-679",
"trust": 0.7
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-681"
},
{
"db": "ZDI",
"id": "ZDI-24-680"
},
{
"db": "ZDI",
"id": "ZDI-24-679"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009680"
},
{
"db": "NVD",
"id": "CVE-2024-37029"
}
]
},
"id": "VAR-202406-0374",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 1.0
},
"last_update_date": "2024-10-05T19:42:33.215000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 2.1,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-14"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-681"
},
{
"db": "ZDI",
"id": "ZDI-24-680"
},
{
"db": "ZDI",
"id": "ZDI-24-679"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-121",
"trust": 1.0
},
{
"problemtype": "Stack-based buffer overflow (CWE-121) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009680"
},
{
"db": "NVD",
"id": "CVE-2024-37029"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.9,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-14"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu96920775/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-37029"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-681"
},
{
"db": "ZDI",
"id": "ZDI-24-680"
},
{
"db": "ZDI",
"id": "ZDI-24-679"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009680"
},
{
"db": "NVD",
"id": "CVE-2024-37029"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-24-681"
},
{
"db": "ZDI",
"id": "ZDI-24-680"
},
{
"db": "ZDI",
"id": "ZDI-24-679"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009680"
},
{
"db": "NVD",
"id": "CVE-2024-37029"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-06-13T00:00:00",
"db": "ZDI",
"id": "ZDI-24-681"
},
{
"date": "2024-06-13T00:00:00",
"db": "ZDI",
"id": "ZDI-24-680"
},
{
"date": "2024-06-13T00:00:00",
"db": "ZDI",
"id": "ZDI-24-679"
},
{
"date": "2024-10-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-009680"
},
{
"date": "2024-06-13T18:15:10.790000",
"db": "NVD",
"id": "CVE-2024-37029"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-681"
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-680"
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-679"
},
{
"date": "2024-10-04T02:23:00",
"db": "JVNDB",
"id": "JVNDB-2024-009680"
},
{
"date": "2024-10-03T16:43:40.713000",
"db": "NVD",
"id": "CVE-2024-37029"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Tellus Lite V-Simulator 6 V9 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability",
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-680"
},
{
"db": "ZDI",
"id": "ZDI-24-679"
}
],
"trust": 1.4
}
}
VAR-202311-1678
Vulnerability from variot - Updated: 2024-08-14 14:30Stack-based buffer overflow may occur when Fuji Electric Tellus Lite V-Simulator parses a specially-crafted input file. Fuji Electric's Tellus Lite V-Simulator Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of V9 files by the V-Simulator 6 module. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202311-1678",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tellus lite",
"scope": null,
"trust": 7.7,
"vendor": "fuji electric",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "lt",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.19.0"
},
{
"model": "tellus lite v-simulator",
"scope": null,
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "4.0.19.0"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kimiya",
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
}
],
"trust": 7.7
},
"cve": "CVE-2023-35127",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2023-35127",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 7.7,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2023-35127",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2023-35127",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "ZDI",
"id": "CVE-2023-35127",
"trust": 7.7,
"value": "HIGH"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2023-35127",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2023-35127",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2023-35127",
"trust": 0.8,
"value": "High"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"db": "NVD",
"id": "CVE-2023-35127"
},
{
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack-based buffer overflow may occur when Fuji Electric Tellus Lite V-Simulator parses a specially-crafted input file. Fuji Electric\u0027s Tellus Lite V-Simulator Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of V9 files by the V-Simulator 6 module. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-35127"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
},
{
"db": "VULMON",
"id": "CVE-2023-35127"
}
],
"trust": 8.64
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-35127",
"trust": 10.4
},
{
"db": "ICS CERT",
"id": "ICSA-23-325-02",
"trust": 1.9
},
{
"db": "JVN",
"id": "JVNVU98886797",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018332",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21214",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1734",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21304",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1733",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21303",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1732",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21302",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1731",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21236",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1728",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21176",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1727",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21178",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1726",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21175",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1723",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21174",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1722",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21215",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1721",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21121",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1720",
"trust": 0.7
},
{
"db": "VULMON",
"id": "CVE-2023-35127",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
},
{
"db": "VULMON",
"id": "CVE-2023-35127"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"id": "VAR-202311-1678",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 1.0
},
"last_update_date": "2024-08-14T14:30:09.043000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 7.7,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-121",
"trust": 1.0
},
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "Out-of-bounds writing (CWE-787) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 9.7,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02"
},
{
"trust": 1.9,
"url": "https://felib.fujielectric.co.jp/en/m10009/m20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98886797/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-35127"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
},
{
"db": "VULMON",
"id": "CVE-2023-35127"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
},
{
"db": "VULMON",
"id": "CVE-2023-35127"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1720"
},
{
"date": "2023-11-22T00:00:00",
"db": "VULMON",
"id": "CVE-2023-35127"
},
{
"date": "2024-01-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"date": "2023-11-22T01:15:07.813000",
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1720"
},
{
"date": "2023-11-22T00:00:00",
"db": "VULMON",
"id": "CVE-2023-35127"
},
{
"date": "2024-01-11T02:46:00",
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"date": "2023-11-30T17:24:26.147000",
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Tellus Lite V-Simulator 6 V9 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability",
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
}
],
"trust": 7.7
}
}
VAR-202311-1679
Vulnerability from variot - Updated: 2024-08-14 14:30When Fuji Electric Tellus Lite V-Simulator parses a specially-crafted input file an out of bounds write may occur. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of V9 files by the V-Simulator module. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202311-1679",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tellus lite",
"scope": null,
"trust": 2.8,
"vendor": "fuji electric",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "lt",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.19.0"
},
{
"model": "tellus lite v-simulator",
"scope": null,
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "4.0.19.0"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kimiya",
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
}
],
"trust": 2.8
},
"cve": "CVE-2023-40152",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2023-40152",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.8,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2023-40152",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2023-40152",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "ZDI",
"id": "CVE-2023-40152",
"trust": 2.8,
"value": "HIGH"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2023-40152",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2023-40152",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2023-40152",
"trust": 0.8,
"value": "High"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"db": "NVD",
"id": "CVE-2023-40152"
},
{
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "When Fuji Electric Tellus Lite V-Simulator parses a specially-crafted input file an out of bounds write may occur. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of V9 files by the V-Simulator module. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-40152"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
},
{
"db": "VULMON",
"id": "CVE-2023-40152"
}
],
"trust": 4.23
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-40152",
"trust": 5.5
},
{
"db": "ICS CERT",
"id": "ICSA-23-325-02",
"trust": 1.9
},
{
"db": "JVN",
"id": "JVNVU98886797",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018324",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21212",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1735",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21238",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1729",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21211",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1725",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21210",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1724",
"trust": 0.7
},
{
"db": "VULMON",
"id": "CVE-2023-40152",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
},
{
"db": "VULMON",
"id": "CVE-2023-40152"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"id": "VAR-202311-1679",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 1.0
},
"last_update_date": "2024-08-14T14:30:08.974000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 2.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "Out-of-bounds writing (CWE-787) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02"
},
{
"trust": 1.9,
"url": "https://felib.fujielectric.co.jp/en/m10009/m20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98886797/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-40152"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
},
{
"db": "VULMON",
"id": "CVE-2023-40152"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
},
{
"db": "VULMON",
"id": "CVE-2023-40152"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1724"
},
{
"date": "2023-11-22T00:00:00",
"db": "VULMON",
"id": "CVE-2023-40152"
},
{
"date": "2024-01-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"date": "2023-11-22T01:15:08.007000",
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1724"
},
{
"date": "2023-11-22T00:00:00",
"db": "VULMON",
"id": "CVE-2023-40152"
},
{
"date": "2024-01-11T02:35:00",
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"date": "2023-11-30T17:28:53.117000",
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Tellus Lite V-Simulator V9 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability",
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
}
],
"trust": 2.1
}
}
VAR-202212-1811
Vulnerability from variot - Updated: 2024-08-14 14:02Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to an out-of-bounds write which may allow an attacker to execute arbitrary code. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of X1 files in the V-Simulator 6 application. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202212-1811",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tellus lite",
"scope": null,
"trust": 2.8,
"vendor": "fuji electric",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "lte",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.12.0"
},
{
"model": "tellus lite v-simulator",
"scope": "lte",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "4.0.12.0 and earlier"
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-823"
},
{
"db": "ZDI",
"id": "ZDI-23-822"
},
{
"db": "ZDI",
"id": "ZDI-23-820"
},
{
"db": "ZDI",
"id": "ZDI-23-819"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-005595"
},
{
"db": "NVD",
"id": "CVE-2022-3087"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kimiya",
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-823"
},
{
"db": "ZDI",
"id": "ZDI-23-822"
},
{
"db": "ZDI",
"id": "ZDI-23-820"
},
{
"db": "ZDI",
"id": "ZDI-23-819"
}
],
"trust": 2.8
},
"cve": "CVE-2022-3087",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2022-3087",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.8,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2022-3087",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "OTHER",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2022-005595",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "ZDI",
"id": "CVE-2022-3087",
"trust": 2.8,
"value": "HIGH"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2022-3087",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2022-3087",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "OTHER",
"id": "JVNDB-2022-005595",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-202212-3660",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-823"
},
{
"db": "ZDI",
"id": "ZDI-23-822"
},
{
"db": "ZDI",
"id": "ZDI-23-820"
},
{
"db": "ZDI",
"id": "ZDI-23-819"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-005595"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-3660"
},
{
"db": "NVD",
"id": "CVE-2022-3087"
},
{
"db": "NVD",
"id": "CVE-2022-3087"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "\nFuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to an out-of-bounds write which may allow an attacker to execute arbitrary code. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of X1 files in the V-Simulator 6 application. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-3087"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-005595"
},
{
"db": "ZDI",
"id": "ZDI-23-823"
},
{
"db": "ZDI",
"id": "ZDI-23-822"
},
{
"db": "ZDI",
"id": "ZDI-23-820"
},
{
"db": "ZDI",
"id": "ZDI-23-819"
},
{
"db": "VULMON",
"id": "CVE-2022-3087"
}
],
"trust": 4.23
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-3087",
"trust": 6.1
},
{
"db": "ICS CERT",
"id": "ICSA-22-354-01",
"trust": 2.5
},
{
"db": "JVN",
"id": "JVNVU90957471",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2022-005595",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-16781",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-823",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-16779",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-822",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-16602",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-820",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-16600",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-819",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2022.6634",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202212-3660",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2022-3087",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-823"
},
{
"db": "ZDI",
"id": "ZDI-23-822"
},
{
"db": "ZDI",
"id": "ZDI-23-820"
},
{
"db": "ZDI",
"id": "ZDI-23-819"
},
{
"db": "VULMON",
"id": "CVE-2022-3087"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-005595"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-3660"
},
{
"db": "NVD",
"id": "CVE-2022-3087"
}
]
},
"id": "VAR-202212-1811",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 1.0
},
"last_update_date": "2024-08-14T14:02:11.107000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 2.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-354-01"
},
{
"title": "Top\u00a0Page",
"trust": 0.8,
"url": "https://www.fujielectric.co.jp/"
},
{
"title": "Fuji Electric Tellus Lite V-Simulator Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=218427"
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/Live-Hack-CVE/CVE-2022-3087 "
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-823"
},
{
"db": "ZDI",
"id": "ZDI-23-822"
},
{
"db": "ZDI",
"id": "ZDI-23-820"
},
{
"db": "ZDI",
"id": "ZDI-23-819"
},
{
"db": "VULMON",
"id": "CVE-2022-3087"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-005595"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-3660"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "Out-of-bounds writing (CWE-787) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-005595"
},
{
"db": "NVD",
"id": "CVE-2022-3087"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.6,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-354-01"
},
{
"trust": 1.7,
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-354-01"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu90957471/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-3087"
},
{
"trust": 0.6,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-354-01"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-3087/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.6634"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"trust": 0.1,
"url": "https://github.com/live-hack-cve/cve-2022-3087"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-823"
},
{
"db": "ZDI",
"id": "ZDI-23-822"
},
{
"db": "ZDI",
"id": "ZDI-23-820"
},
{
"db": "ZDI",
"id": "ZDI-23-819"
},
{
"db": "VULMON",
"id": "CVE-2022-3087"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-005595"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-3660"
},
{
"db": "NVD",
"id": "CVE-2022-3087"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-23-823"
},
{
"db": "ZDI",
"id": "ZDI-23-822"
},
{
"db": "ZDI",
"id": "ZDI-23-820"
},
{
"db": "ZDI",
"id": "ZDI-23-819"
},
{
"db": "VULMON",
"id": "CVE-2022-3087"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-005595"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-3660"
},
{
"db": "NVD",
"id": "CVE-2022-3087"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-06-08T00:00:00",
"db": "ZDI",
"id": "ZDI-23-823"
},
{
"date": "2023-06-08T00:00:00",
"db": "ZDI",
"id": "ZDI-23-822"
},
{
"date": "2023-06-08T00:00:00",
"db": "ZDI",
"id": "ZDI-23-820"
},
{
"date": "2023-06-08T00:00:00",
"db": "ZDI",
"id": "ZDI-23-819"
},
{
"date": "2023-01-17T00:00:00",
"db": "VULMON",
"id": "CVE-2022-3087"
},
{
"date": "2023-06-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-005595"
},
{
"date": "2022-12-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202212-3660"
},
{
"date": "2023-01-17T00:15:10.413000",
"db": "NVD",
"id": "CVE-2022-3087"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-06-08T00:00:00",
"db": "ZDI",
"id": "ZDI-23-823"
},
{
"date": "2023-06-08T00:00:00",
"db": "ZDI",
"id": "ZDI-23-822"
},
{
"date": "2023-06-08T00:00:00",
"db": "ZDI",
"id": "ZDI-23-820"
},
{
"date": "2023-06-08T00:00:00",
"db": "ZDI",
"id": "ZDI-23-819"
},
{
"date": "2023-01-17T00:00:00",
"db": "VULMON",
"id": "CVE-2022-3087"
},
{
"date": "2023-06-06T08:56:00",
"db": "JVNDB",
"id": "JVNDB-2022-005595"
},
{
"date": "2023-01-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202212-3660"
},
{
"date": "2023-11-07T03:50:46.330000",
"db": "NVD",
"id": "CVE-2022-3087"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202212-3660"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Tellus Lite V-Simulator 6 X1 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability",
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-823"
},
{
"db": "ZDI",
"id": "ZDI-23-822"
},
{
"db": "ZDI",
"id": "ZDI-23-820"
},
{
"db": "ZDI",
"id": "ZDI-23-819"
}
],
"trust": 2.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202212-3660"
}
],
"trust": 0.6
}
}
CVE-2024-11803 (GCVE-0-2024-11803)
Vulnerability from nvd – Published: 2024-11-27 23:35 – Updated: 2024-11-29 16:49
VLAI?
Title
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Summary
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24771.
Severity ?
7.8 (High)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fuji Electric | Tellus Lite |
Affected:
4.0.20.0
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:tellus_lite:4.0.20.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tellus_lite",
"vendor": "fujielectric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11803",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T16:43:24.101858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T16:49:45.694Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Tellus Lite",
"vendor": "Fuji Electric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"dateAssigned": "2024-11-26T10:02:55.944-06:00",
"datePublic": "2024-11-27T15:01:21.137-06:00",
"descriptions": [
{
"lang": "en",
"value": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24771."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T23:35:16.103Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-1629",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1629/"
}
],
"source": {
"lang": "en",
"value": "kimiya"
},
"title": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-11803",
"datePublished": "2024-11-27T23:35:16.103Z",
"dateReserved": "2024-11-26T16:02:55.924Z",
"dateUpdated": "2024-11-29T16:49:45.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11802 (GCVE-0-2024-11802)
Vulnerability from nvd – Published: 2024-11-27 23:35 – Updated: 2024-11-29 16:49
VLAI?
Title
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-Based Buffer Overflow Remote Code Execution Vulnerability
Summary
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24770.
Severity ?
7.8 (High)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fuji Electric | Tellus Lite |
Affected:
4.0.20.0
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:tellus_lite:4.0.20.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tellus_lite",
"vendor": "fujielectric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11802",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T16:43:24.101858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T16:49:45.531Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Tellus Lite",
"vendor": "Fuji Electric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"dateAssigned": "2024-11-26T10:02:48.356-06:00",
"datePublic": "2024-11-27T15:01:08.699-06:00",
"descriptions": [
{
"lang": "en",
"value": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24770."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T23:35:12.023Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-1628",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1628/"
}
],
"source": {
"lang": "en",
"value": "kimiya"
},
"title": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-Based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-11802",
"datePublished": "2024-11-27T23:35:12.023Z",
"dateReserved": "2024-11-26T16:02:48.337Z",
"dateUpdated": "2024-11-29T16:49:45.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11801 (GCVE-0-2024-11801)
Vulnerability from nvd – Published: 2024-11-27 23:35 – Updated: 2024-11-29 16:49
VLAI?
Title
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Summary
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24769.
Severity ?
7.8 (High)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fuji Electric | Tellus Lite |
Affected:
4.0.20.0
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:tellus_lite:4.0.20.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tellus_lite",
"vendor": "fujielectric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11801",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T16:43:24.101858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T16:49:30.465Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Tellus Lite",
"vendor": "Fuji Electric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"dateAssigned": "2024-11-26T10:02:40.982-06:00",
"datePublic": "2024-11-27T15:00:58.123-06:00",
"descriptions": [
{
"lang": "en",
"value": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24769."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T23:35:06.196Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-1627",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1627/"
}
],
"source": {
"lang": "en",
"value": "kimiya"
},
"title": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-11801",
"datePublished": "2024-11-27T23:35:06.196Z",
"dateReserved": "2024-11-26T16:02:40.960Z",
"dateUpdated": "2024-11-29T16:49:30.465Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11800 (GCVE-0-2024-11800)
Vulnerability from nvd – Published: 2024-11-27 23:35 – Updated: 2024-11-29 16:49
VLAI?
Title
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Summary
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24768.
Severity ?
7.8 (High)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fuji Electric | Tellus Lite |
Affected:
4.0.20.0
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:tellus_lite:4.0.20.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tellus_lite",
"vendor": "fujielectric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11800",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T16:43:24.101858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T16:49:44.955Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Tellus Lite",
"vendor": "Fuji Electric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"dateAssigned": "2024-11-26T10:02:34.554-06:00",
"datePublic": "2024-11-27T15:00:46.748-06:00",
"descriptions": [
{
"lang": "en",
"value": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24768."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T23:35:01.965Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-1626",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1626/"
}
],
"source": {
"lang": "en",
"value": "kimiya"
},
"title": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-11800",
"datePublished": "2024-11-27T23:35:01.965Z",
"dateReserved": "2024-11-26T16:02:34.534Z",
"dateUpdated": "2024-11-29T16:49:44.955Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11799 (GCVE-0-2024-11799)
Vulnerability from nvd – Published: 2024-11-27 23:34 – Updated: 2024-11-29 16:45
VLAI?
Title
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Summary
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24664.
Severity ?
7.8 (High)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fuji Electric | Tellus Lite |
Affected:
4.0.20.0
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:tellus_lite:4.0.20.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tellus_lite",
"vendor": "fujielectric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11799",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T16:43:24.101858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T16:45:20.598Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Tellus Lite",
"vendor": "Fuji Electric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"dateAssigned": "2024-11-26T10:02:30.128-06:00",
"datePublic": "2024-11-27T15:00:35.617-06:00",
"descriptions": [
{
"lang": "en",
"value": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24664."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T23:34:57.579Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-1625",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1625/"
}
],
"source": {
"lang": "en",
"value": "kimiya"
},
"title": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-11799",
"datePublished": "2024-11-27T23:34:57.579Z",
"dateReserved": "2024-11-26T16:02:30.077Z",
"dateUpdated": "2024-11-29T16:45:20.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11803 (GCVE-0-2024-11803)
Vulnerability from cvelistv5 – Published: 2024-11-27 23:35 – Updated: 2024-11-29 16:49
VLAI?
Title
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Summary
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24771.
Severity ?
7.8 (High)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fuji Electric | Tellus Lite |
Affected:
4.0.20.0
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:tellus_lite:4.0.20.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tellus_lite",
"vendor": "fujielectric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11803",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T16:43:24.101858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T16:49:45.694Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Tellus Lite",
"vendor": "Fuji Electric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"dateAssigned": "2024-11-26T10:02:55.944-06:00",
"datePublic": "2024-11-27T15:01:21.137-06:00",
"descriptions": [
{
"lang": "en",
"value": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24771."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T23:35:16.103Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-1629",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1629/"
}
],
"source": {
"lang": "en",
"value": "kimiya"
},
"title": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-11803",
"datePublished": "2024-11-27T23:35:16.103Z",
"dateReserved": "2024-11-26T16:02:55.924Z",
"dateUpdated": "2024-11-29T16:49:45.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11802 (GCVE-0-2024-11802)
Vulnerability from cvelistv5 – Published: 2024-11-27 23:35 – Updated: 2024-11-29 16:49
VLAI?
Title
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-Based Buffer Overflow Remote Code Execution Vulnerability
Summary
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24770.
Severity ?
7.8 (High)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fuji Electric | Tellus Lite |
Affected:
4.0.20.0
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:tellus_lite:4.0.20.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tellus_lite",
"vendor": "fujielectric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11802",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T16:43:24.101858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T16:49:45.531Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Tellus Lite",
"vendor": "Fuji Electric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"dateAssigned": "2024-11-26T10:02:48.356-06:00",
"datePublic": "2024-11-27T15:01:08.699-06:00",
"descriptions": [
{
"lang": "en",
"value": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24770."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T23:35:12.023Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-1628",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1628/"
}
],
"source": {
"lang": "en",
"value": "kimiya"
},
"title": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-Based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-11802",
"datePublished": "2024-11-27T23:35:12.023Z",
"dateReserved": "2024-11-26T16:02:48.337Z",
"dateUpdated": "2024-11-29T16:49:45.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11801 (GCVE-0-2024-11801)
Vulnerability from cvelistv5 – Published: 2024-11-27 23:35 – Updated: 2024-11-29 16:49
VLAI?
Title
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Summary
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24769.
Severity ?
7.8 (High)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fuji Electric | Tellus Lite |
Affected:
4.0.20.0
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:tellus_lite:4.0.20.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tellus_lite",
"vendor": "fujielectric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11801",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T16:43:24.101858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T16:49:30.465Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Tellus Lite",
"vendor": "Fuji Electric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"dateAssigned": "2024-11-26T10:02:40.982-06:00",
"datePublic": "2024-11-27T15:00:58.123-06:00",
"descriptions": [
{
"lang": "en",
"value": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24769."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T23:35:06.196Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-1627",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1627/"
}
],
"source": {
"lang": "en",
"value": "kimiya"
},
"title": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-11801",
"datePublished": "2024-11-27T23:35:06.196Z",
"dateReserved": "2024-11-26T16:02:40.960Z",
"dateUpdated": "2024-11-29T16:49:30.465Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11800 (GCVE-0-2024-11800)
Vulnerability from cvelistv5 – Published: 2024-11-27 23:35 – Updated: 2024-11-29 16:49
VLAI?
Title
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Summary
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24768.
Severity ?
7.8 (High)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fuji Electric | Tellus Lite |
Affected:
4.0.20.0
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:tellus_lite:4.0.20.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tellus_lite",
"vendor": "fujielectric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11800",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T16:43:24.101858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T16:49:44.955Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Tellus Lite",
"vendor": "Fuji Electric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"dateAssigned": "2024-11-26T10:02:34.554-06:00",
"datePublic": "2024-11-27T15:00:46.748-06:00",
"descriptions": [
{
"lang": "en",
"value": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24768."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T23:35:01.965Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-1626",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1626/"
}
],
"source": {
"lang": "en",
"value": "kimiya"
},
"title": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-11800",
"datePublished": "2024-11-27T23:35:01.965Z",
"dateReserved": "2024-11-26T16:02:34.534Z",
"dateUpdated": "2024-11-29T16:49:44.955Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11799 (GCVE-0-2024-11799)
Vulnerability from cvelistv5 – Published: 2024-11-27 23:34 – Updated: 2024-11-29 16:45
VLAI?
Title
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Summary
Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24664.
Severity ?
7.8 (High)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fuji Electric | Tellus Lite |
Affected:
4.0.20.0
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:tellus_lite:4.0.20.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tellus_lite",
"vendor": "fujielectric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11799",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T16:43:24.101858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T16:45:20.598Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Tellus Lite",
"vendor": "Fuji Electric",
"versions": [
{
"status": "affected",
"version": "4.0.20.0"
}
]
}
],
"dateAssigned": "2024-11-26T10:02:30.128-06:00",
"datePublic": "2024-11-27T15:00:35.617-06:00",
"descriptions": [
{
"lang": "en",
"value": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24664."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T23:34:57.579Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-1625",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1625/"
}
],
"source": {
"lang": "en",
"value": "kimiya"
},
"title": "Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-11799",
"datePublished": "2024-11-27T23:34:57.579Z",
"dateReserved": "2024-11-26T16:02:30.077Z",
"dateUpdated": "2024-11-29T16:45:20.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}