CVE-2023-32538
📋 TL;DR
A stack-based buffer overflow vulnerability in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0 allows attackers to execute arbitrary code or disclose information by tricking users into opening malicious SIM2 files. This affects industrial control systems using these specific versions of Fuji Electric's TELLUS software. The vulnerability is distinct from similar CVEs affecting the same software.
💻 Affected Systems
- TELLUS
- TELLUS Lite
📦 What is this software?
Tellus by Fujielectric
Tellus Lite by Fujielectric
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution leading to industrial process disruption, data theft, or ransomware deployment on affected systems.
Likely Case
Local privilege escalation leading to unauthorized access to industrial control systems and potential manipulation of monitoring data.
If Mitigated
Limited impact with proper network segmentation and user awareness preventing malicious file execution.
🎯 Exploit Status
Requires user interaction (opening malicious file). No public exploit code available as of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v4.0.16.0 or later
Vendor Advisory: https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php
Restart Required: Yes
Instructions:
1. Download updated version from Fuji Electric's website. 2. Backup configuration files. 3. Install update following vendor instructions. 4. Restart system. 5. Verify version update.
🔧 Temporary Workarounds
Restrict SIM2 file handling
windowsBlock or restrict opening of SIM2 files from untrusted sources
User awareness training
allTrain operators to only open SIM2 files from trusted sources
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized executables
- Network segmentation to isolate TELLUS systems from general network
🔍 How to Verify
Check if Vulnerable:
Check TELLUS version in application Help > About menuCheck Version:
Not applicable - check through application GUIVerify Fix Applied:
Verify version is v4.0.16.0 or later in Help > About menu📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes
- Unusual file access patterns for SIM2 files
- Failed application updates
Network Indicators:
- Unusual outbound connections from TELLUS systems
- File transfers to/from TELLUS systems
SIEM Query:
Process:TELLUS.exe AND (EventID:1000 OR EventID:1001) OR FileExtension:.sim2 AND SourceIP:External