# Fuji Electric Tellus Lite V-Simulator buffer overflow flaws

Published: 2025-07-29 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/bee72437-82b8-56fa-8b1f-f35d7981c16e/fuji-electric-tellus-lite-v-simulator-buffer-overflow-flaws

> Five out-of-bounds write vulnerabilities in Fuji Electric Tellus Lite V-Simulator enable arbitrary code execution via malicious V8 files requiring user interaction.

CISA has disclosed five out-of-bounds write vulnerabilities (CWE-787) affecting Fuji Electric Tellus Lite V-Simulator version 4.0.20.0. These flaws exist in the V-Simulator 5 component's parsing of V8 files and result from insufficient validation of user-supplied data before copying to fixed-length buffers. Exploitation requires user interaction—opening a malicious file or visiting a malicious page—but can result in arbitrary code execution in the current process context. All five vulnerabilities carry CVSS v4 scores of 8.4 and v3.1 scores of 7.8, reflecting high severity despite the interaction requirement.

No public exploitation has been reported. Fuji Electric has mitigated the risk by replacing V-Simulator Ver5 with Ver6 (which screens incoming data) in new product versions. The company released TELLUS V4.0.22.0 in May 2025, which fixes CVE-2024-11802 and CVE-2024-11803 in V-Simulator Ver6 and removes the vulnerable Ver5 component. Defenders should upgrade to the latest version and apply standard defenses against malicious file delivery, particularly email-based social engineering.

## Mentioned in this report

- Vulnerabilities: CVE-2024-11799, CVE-2024-11800, CVE-2024-11801, CVE-2024-11802, CVE-2024-11803

## Detection guidance (public sample)

### Fuji Electric Tellus V-Simulator Spawning Command Interpreter or LOLBin

ATT&CK: T1204.002

Detects a Tellus / V-Simulator process spawning a shell or script host, which is consistent with code execution after a malicious V8 file triggers an out-of-bounds write. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Fuji Electric Tellus V-Simulator Spawning Command Interpreter or LOLBin
description: Detects Tellus or V-Simulator processes spawning shells, script hosts
  or common LOLBins. Opening a malicious V8 file that exploits the out-of-bounds write
  flaws (CWE-787) would give code execution in the simulator's process context, so
  a child process like this is a strong post-exploitation signal. The simulator has
  little legitimate reason to start these children.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - V-Simulator
    - VSimulator
    - Tellus
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection_parent and selection_child
falsepositives:
- Vendor installer or updater launching cmd.exe during Tellus setup or upgrade
- Engineers running a simulator export script that calls a shell
level: high
id: 1ebe99c0-1206-54c6-b568-fc7f5e69b81a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-06
```

### V8 Project File Dropped by Email Client or Browser

ATT&CK: T1566.001

Detects .v8 files (Tellus / V-Simulator project format) written to disk by an email client or web browser, indicating delivery of a potentially malicious file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: V8 Project File Dropped by Email Client or Browser
description: Detects creation of .v8 files (Fuji Electric Tellus / V-Simulator screen
  data format) by Outlook or a web browser. The advisory says exploitation needs the
  user to open a malicious file or visit a malicious page, with email-based social
  engineering as the expected delivery path. Most useful in environments that do not
  routinely exchange these files by email.
tags:
- attack.initial-access
- attack.t1566.001
- attack.execution
- attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \OUTLOOK.EXE
    - \chrome.exe
    - \msedge.exe
    - \firefox.exe
    - \brave.exe
    TargetFilename|endswith: .v8
  condition: selection
falsepositives:
- Control-system engineers legitimately receiving V8 project files from vendors or
  colleagues by email or download
- Integrators downloading sample projects from the vendor website
level: low
id: 2dbfb904-01aa-5c43-b2bf-8f6ae965f37d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-06
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-06

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/bee72437-82b8-56fa-8b1f-f35d7981c16e/fuji-electric-tellus-lite-v-simulator-buffer-overflow-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup