CVE-2023-32276
📋 TL;DR
A stack-based buffer overflow vulnerability in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0 allows attackers to execute arbitrary code or disclose information by tricking users into opening specially crafted V8 files. This affects industrial control system operators using these specific versions of Fuji Electric's TELLUS software for monitoring and control applications.
💻 Affected Systems
- TELLUS
- TELLUS Lite
📦 What is this software?
Tellus by Fujielectric
Tellus Lite by Fujielectric
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution leading to industrial process disruption, data theft, or lateral movement within operational technology networks.
Likely Case
Local privilege escalation or denial of service on affected systems when users open malicious V8 files, potentially disrupting monitoring operations.
If Mitigated
Limited impact with proper network segmentation and user awareness preventing malicious file execution.
🎯 Exploit Status
Requires user interaction to open malicious file; buffer overflow exploitation requires specific knowledge of TELLUS V8 file format.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to version beyond v4.0.15.0
Vendor Advisory: https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php
Restart Required: Yes
Instructions:
1. Download latest TELLUS/TELLUS Lite version from Fuji Electric's website. 2. Backup existing configurations. 3. Install updated version. 4. Restart system. 5. Verify version update.
🔧 Temporary Workarounds
Restrict V8 file handling
windowsBlock or restrict opening of .v8 files from untrusted sources
User awareness training
allTrain users not to open V8 files from unknown sources
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized V8 file execution
- Network segmentation to isolate TELLUS systems from general user networks
🔍 How to Verify
Check if Vulnerable:
Check TELLUS/TELLUS Lite version in application about dialog or installation directoryCheck Version:
Check application properties or about dialog in TELLUS softwareVerify Fix Applied:
Confirm version is no longer v4.0.15.0 after update📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening V8 files
- Unusual process execution from TELLUS
Network Indicators:
- Unexpected file transfers of V8 files to TELLUS systems
SIEM Query:
Process creation where parent process contains 'TELLUS' and command line contains .v8 file extension