Fuji Electric Tellus Lite V-Simulator 5 Stack-Based Buffer Overflow (CVE-2024-11802)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: - (0Day) Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-Based Buffer Overflow Remote Code Execution Vulnerability 2. Vulnerability ID: - ZDI-24-1628 - ZDI-CAN-24770 3. CVE ID: - CVE-2024-11802 4. CVSS Score: - 7.8 5. Affected Vendor: - Fuji Electric 6. Affected Product: - Tellus Lite 7. Vulnerability Details: - Remote attackers can exploit this vulnerability to execute arbitrary code on affected Fuji Electric Tellus Lite installations. User interaction with a malicious page or file is required to exploit this vulnerability. - The issue exists in the V8 file parsing within the V-Simulator 5 component. The problem arises from insufficient length validation before copying user-supplied data into a fixed-length stack buffer. Attackers can exploit this to execute code within the context of the current process. 8. Additional Details: - 2024-07-18 - ZDI reported the vulnerability to the vendor - 2024-07-18 - Vendor acknowledged receipt of the report - 2024-08-21 - Vendor confirmed the reported issue and requested a delay until April 2025 - 2024-10-07 - ZDI notified the vendor of its intention to publish this case as a 0-day advisory 9. Disclosure Timeline: - 2024-07-18 - Vulnerability reported to vendor - 2024-11-27 - Coordinated public advisory released - 2024-11-27 - Advisory updated 10. Credit: - kimiya 11. Return to Advisory: - Return to Advisory This information provides a detailed description of the vulnerability, including its nature, scope of impact, discovery, and disclosure process.

Goal Reached Thanks to every supporter — we hit 100%!

Fuji Electric Tellus Lite V-Simulator 5 Stack-Based Buffer Overflow (CVE-2024-11802)