CVE-2023-35127
📋 TL;DR
A stack-based buffer overflow vulnerability in Fuji Electric Tellus Lite V-Simulator allows remote attackers to execute arbitrary code by tricking a user into opening a malicious input file. This affects users of the Tellus Lite V-Simulator software, potentially leading to system compromise.
💻 Affected Systems
- Fuji Electric Tellus Lite V-Simulator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, or disruption of industrial control processes.
Likely Case
Local code execution on the user's machine, potentially enabling privilege escalation or malware installation.
If Mitigated
Limited impact if file parsing is restricted to trusted sources and software is isolated from critical systems.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious file; no public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched version.
Vendor Advisory: https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a
Restart Required: Yes
Instructions:
1. Visit the vendor advisory URL. 2. Download and install the latest version of Tellus Lite V-Simulator. 3. Restart the system to apply changes.
🔧 Temporary Workarounds
Restrict File Access
allLimit file parsing to trusted sources and avoid opening untrusted input files.
Network Segmentation
allIsolate systems running the simulator from critical networks to reduce attack surface.
🧯 If You Can't Patch
- Implement strict access controls and user training to avoid opening suspicious files.
- Use application whitelisting to prevent unauthorized software execution.
🔍 How to Verify
Check if Vulnerable:
Check the software version against the vendor advisory; if using an older version, assume vulnerable.Check Version:
Check within the Tellus Lite V-Simulator application interface or system documentation for version info.Verify Fix Applied:
Verify installation of the patched version from vendor sources and confirm no crashes occur with test files.📡 Detection & Monitoring
Log Indicators:
- Application crashes, unexpected file access, or error logs related to buffer overflow in Tellus Lite.
Network Indicators:
- Unusual file transfers to systems running the simulator.
SIEM Query:
Search for event logs indicating Tellus Lite process termination or file parsing errors.🔗 References
- https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02
- https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02
