CVE-2021-22653
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code on affected systems by crafting malicious project files that trigger out-of-bounds writes. It affects Tellus Lite V-Simulator and V-Server Lite software versions prior to 4.0.10.0, potentially compromising industrial control systems.
💻 Affected Systems
- Tellus Lite V-Simulator
- Tellus Lite V-Server Lite
📦 What is this software?
V Server by Fujielectric
V Simulator by Fujielectric
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to execute arbitrary code, disrupt industrial processes, steal sensitive data, or pivot to other network systems.
Likely Case
Local privilege escalation or remote code execution when malicious project files are loaded, potentially disrupting industrial operations.
If Mitigated
Limited impact with proper network segmentation and file validation controls in place.
🎯 Exploit Status
Exploitation requires the victim to load a malicious project file, which could be delivered via social engineering or compromised project repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.10.0
Vendor Advisory: https://us-cert.cisa.gov/ics/advisories/icsa-21-026-01
Restart Required: Yes
Instructions:
1. Download version 4.0.10.0 or later from the vendor. 2. Backup existing configurations and project files. 3. Install the update following vendor instructions. 4. Restart the application and verify functionality.
🔧 Temporary Workarounds
Restrict project file sources
allOnly load project files from trusted, verified sources and implement file validation procedures.
Network segmentation
allIsolate affected systems from untrusted networks and implement strict firewall rules.
🧯 If You Can't Patch
- Implement strict access controls to prevent untrusted users from loading project files
- Deploy application whitelisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check software version in application settings or About dialog. If version is below 4.0.10.0, system is vulnerable.Check Version:
Check application GUI or documentation for version information (no standard CLI command available)Verify Fix Applied:
Verify version is 4.0.10.0 or higher and test loading of legitimate project files to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- Failed project file loads
- Unexpected application crashes
- Suspicious process creation after file load
Network Indicators:
- Unexpected network connections from Tellus processes
- File transfers to/from Tellus systems
SIEM Query:
Process creation where parent process contains 'Tellus' AND (command line contains '.prj' OR file path contains project files)