Fuji Electric Tellus Lite V-Simulator buffer overflow flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Five out-of-bounds write vulnerabilities in Fuji Electric Tellus Lite V-Simulator enable arbitrary code execution via malicious V8 files requiring user interaction.
CISA has disclosed five out-of-bounds write vulnerabilities (CWE-787) affecting Fuji Electric Tellus Lite V-Simulator version 4.0.20.0. These flaws exist in the V-Simulator 5 component's parsing of V8 files and result from insufficient validation of user-supplied data before copying to fixed-length buffers. Exploitation requires user interaction—opening a malicious file or visiting a malicious page—but can result in arbitrary code execution in the current process context. All five vulnerabilities carry CVSS v4 scores of 8.4 and v3.1 scores of 7.8, reflecting high severity despite the interaction requirement.
No public exploitation has been reported. Fuji Electric has mitigated the risk by replacing V-Simulator Ver5 with Ver6 (which screens incoming data) in new product versions. The company released TELLUS V4.0.22.0 in May 2025, which fixes CVE-2024-11802 and CVE-2024-11803 in V-Simulator Ver6 and removes the vulnerable Ver5 component. Defenders should upgrade to the latest version and apply standard defenses against malicious file delivery, particularly email-based social engineering.
Mentioned in this report
Detection guidance
Fuji Electric Tellus V-Simulator Spawning Command Interpreter or LOLBin
Detects a Tellus / V-Simulator process spawning a shell or script host, which is consistent with code execution after a malicious V8 file triggers an out-of-bounds write. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Fuji Electric Tellus V-Simulator Spawning Command Interpreter or LOLBin
description: Detects Tellus or V-Simulator processes spawning shells, script hosts
or common LOLBins. Opening a malicious V8 file that exploits the out-of-bounds write
flaws (CWE-787) would give code execution in the simulator's process context, so
a child process like this is a strong post-exploitation signal. The simulator has
little legitimate reason to start these children.
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- V-Simulator
- VSimulator
- Tellus
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection_parent and selection_child
falsepositives:
- Vendor installer or updater launching cmd.exe during Tellus setup or upgrade
- Engineers running a simulator export script that calls a shell
level: high
id: 1ebe99c0-1206-54c6-b568-fc7f5e69b81a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-06
V8 Project File Dropped by Email Client or Browser
Detects .v8 files (Tellus / V-Simulator project format) written to disk by an email client or web browser, indicating delivery of a potentially malicious file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: V8 Project File Dropped by Email Client or Browser
description: Detects creation of .v8 files (Fuji Electric Tellus / V-Simulator screen
data format) by Outlook or a web browser. The advisory says exploitation needs the
user to open a malicious file or visit a malicious page, with email-based social
engineering as the expected delivery path. Most useful in environments that do not
routinely exchange these files by email.
tags:
- attack.initial-access
- attack.t1566.001
- attack.execution
- attack.t1204.002
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \OUTLOOK.EXE
- \chrome.exe
- \msedge.exe
- \firefox.exe
- \brave.exe
TargetFilename|endswith: .v8
condition: selection
falsepositives:
- Control-system engineers legitimately receiving V8 project files from vendors or
colleagues by email or download
- Integrators downloading sample projects from the vendor website
level: low
id: 2dbfb904-01aa-5c43-b2bf-8f6ae965f37d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-06
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-06
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs