CVE-2025-61864
📋 TL;DR
A use-after-free vulnerability in V-SFT v6.2.7.0 and earlier allows attackers to execute arbitrary code, crash systems, or disclose information by tricking users into opening malicious V-SFT files. This affects industrial control system software used in critical infrastructure environments. Users of Fuji Electric's V-SFT software are vulnerable.
💻 Affected Systems
- Fuji Electric V-SFT
📦 What is this software?
Monitouch V Sft by Fujielectric
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with arbitrary code execution leading to industrial process disruption, data theft, or ransomware deployment in critical infrastructure environments.
Likely Case
System crashes (ABEND) disrupting industrial operations, followed by potential information disclosure or limited code execution in targeted attacks.
If Mitigated
Limited impact with proper network segmentation and file validation, potentially only causing application crashes without system compromise.
🎯 Exploit Status
Requires social engineering to deliver malicious V-SFT files. No public exploit code available as of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v6.2.8.0 or later
Vendor Advisory: https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
Restart Required: Yes
Instructions:
1. Download V-SFT v6.2.8.0 or later from Fuji Electric's download site. 2. Backup existing V-SFT projects. 3. Run installer with administrative privileges. 4. Restart system after installation completes.
🔧 Temporary Workarounds
Restrict V-SFT file execution
windowsBlock execution of V-SFT files from untrusted sources using application control policies
Using AppLocker: New-AppLockerPolicy -RuleType Path -Action Deny -Path "*.vsf" -User Everyone
User training and file validation
allTrain users to only open V-SFT files from trusted sources and implement file hash verification
🧯 If You Can't Patch
- Network segmentation: Isolate V-SFT systems from general corporate network and internet access
- Implement strict file validation: Only allow V-SFT files from whitelisted sources using DLP or email filtering
🔍 How to Verify
Check if Vulnerable:
Check V-SFT version in Help > About. If version is 6.2.7.0 or earlier, system is vulnerable.Check Version:
In V-SFT: Help > About, or check registry: HKEY_LOCAL_MACHINE\SOFTWARE\Fuji Electric\V-SFT\VersionVerify Fix Applied:
Verify version shows 6.2.8.0 or later in Help > About after patch installation.📡 Detection & Monitoring
Log Indicators:
- Application crashes with VS6ComFile.dll errors
- Unexpected V-SFT process termination events
- Multiple failed file load attempts in V-SFT logs
Network Indicators:
- Unusual outbound connections from V-SFT systems
- File transfers to/from V-SFT systems from untrusted sources
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="V-SFT.exe" AND (ExceptionCode=0xc0000005 OR FaultingModule="VS6ComFile.dll")