VAR-202510-0124

Vulnerability from variot - Updated: 2025-12-19 22:38

An out-of-bounds read vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution. None. Fuji Electric V-SFT is a human-machine interface (HMI) configuration software developed by Fuji Electric, primarily used for touchscreen interface design, PDF document viewing, video playback, and alarm message management in industrial automation. This vulnerability stems from the VS6ComFile component's load_link_inf function failing to properly validate the length of input data

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202510-0124",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "monitouch v-sft",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "fujielectric",
        "version": "6.2.7.0"
      },
      {
        "model": "v-sft",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u5bcc\u58eb\u96fb\u6a5f",
        "version": null
      },
      {
        "model": "v-sft",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "\u5bcc\u58eb\u96fb\u6a5f",
        "version": "v6.2.7.0  and earlier"
      },
      {
        "model": "electric v-sft",
        "scope": "lte",
        "trust": 0.6,
        "vendor": "fuji",
        "version": "\u003c=v6.2.7.0"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-24256"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-015451"
      },
      {
        "db": "NVD",
        "id": "CVE-2025-61861"
      }
    ]
  },
  "cve": "CVE-2025-61861",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "CNVD-2025-24256",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "vultures@jpcert.or.jp",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "id": "CVE-2025-61861",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "OTHER",
            "availabilityImpact": "High",
            "baseScore": 7.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2025-015451",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "vultures@jpcert.or.jp",
            "id": "CVE-2025-61861",
            "trust": 1.0,
            "value": "High"
          },
          {
            "author": "OTHER",
            "id": "JVNDB-2025-015451",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2025-24256",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-24256"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-015451"
      },
      {
        "db": "NVD",
        "id": "CVE-2025-61861"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "An out-of-bounds read vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system\u0027s abnormal end (ABEND), and arbitrary code execution. None. Fuji Electric V-SFT is a human-machine interface (HMI) configuration software developed by Fuji Electric, primarily used for touchscreen interface design, PDF document viewing, video playback, and alarm message management in industrial automation. This vulnerability stems from the VS6ComFile component\u0027s load_link_inf function failing to properly validate the length of input data",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2025-61861"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-015451"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2025-24256"
      }
    ],
    "trust": 2.16
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2025-61861",
        "trust": 2.4
      },
      {
        "db": "JVN",
        "id": "JVNVU90008453",
        "trust": 2.4
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-015451",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2025-24256",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-24256"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-015451"
      },
      {
        "db": "NVD",
        "id": "CVE-2025-61861"
      }
    ]
  },
  "id": "VAR-202510-0124",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-24256"
      }
    ],
    "trust": 0.06
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-24256"
      }
    ]
  },
  "last_update_date": "2025-12-19T22:38:41.384000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Improvement information \u00a0No.\u00a025A0H08",
        "trust": 0.8,
        "url": "https://hakko-elec.co.jp/site/download/09vsft6_inf/Search.php"
      },
      {
        "title": "Patch for Fuji Electric V-SFT Out-of-Bounds Read Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/744111"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-24256"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-015451"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-125",
        "trust": 1.0
      },
      {
        "problemtype": "Stack-based buffer overflow (CWE-121) [ others ]",
        "trust": 0.8
      },
      {
        "problemtype": " Out-of-bounds read (CWE-125) [ others ]",
        "trust": 0.8
      },
      {
        "problemtype": " Use of freed memory (CWE-416) [ others ]",
        "trust": 0.8
      },
      {
        "problemtype": " Out-of-bounds writing (CWE-787) [ others ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-015451"
      },
      {
        "db": "NVD",
        "id": "CVE-2025-61861"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.6,
        "url": "https://jvn.jp/en/vu/jvnvu90008453/"
      },
      {
        "trust": 1.0,
        "url": "https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/search.php"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu90008453/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-24256"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-015451"
      },
      {
        "db": "NVD",
        "id": "CVE-2025-61861"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-24256"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-015451"
      },
      {
        "db": "NVD",
        "id": "CVE-2025-61861"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2025-10-21T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2025-24256"
      },
      {
        "date": "2025-10-09T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2025-015451"
      },
      {
        "date": "2025-10-10T11:15:43.970000",
        "db": "NVD",
        "id": "CVE-2025-61861"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2025-11-28T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2025-24256"
      },
      {
        "date": "2025-10-09T03:08:00",
        "db": "JVNDB",
        "id": "JVNDB-2025-015451"
      },
      {
        "date": "2025-10-27T18:06:18.733000",
        "db": "NVD",
        "id": "CVE-2025-61861"
      }
    ]
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Made by Fuji Electric \u00a0V-SFT\u00a0 Multiple vulnerabilities in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2025-015451"
      }
    ],
    "trust": 0.8
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.