Critical Security Alert: Vulnerabilities in Fuji Electric's Monitouch V-SFT Software

In an unsettling development for users of industrial control systems, the Cybersecurity and Infrastructure Security Agency (CISA) has issued a vital security advisory pertaining to vulnerabilities in Fuji Electric's Monitouch V-SFT software. Here's everything you need to know about these vulnerabilities, their implications, and the recommended mitigations.

1. Executive Summary​

According to the advisory, the vulnerabilities have been scored with a CVSS v4 rating of 8.4, indicating a high severity that should not be ignored. Here are the key points:

• Vendor: Fuji Electric
• Affected Equipment: Monitouch V-SFT (specifically, version 6.2.3.0 and prior)
• Vulnerability Type: Out-of-bounds Write
• Overall Risk: An attacker could exploit these vulnerabilities, potentially leading to crashes of the affected devices.

2. Risk Evaluation​

The primary risk associated with these vulnerabilities is the potential for a device crash. Organizations and users relying on the Monitouch V-SFT software should be aware that successful exploitation could disrupt operations, leading to significant downtime and potential financial repercussions.

3. Technical Details​

3.1 Affected Products​

The vulnerabilities are specific to the following version of the Monitouch V-SFT:

• Monitouch V-SFT: Version 6.2.3.0 and earlier.

3.2 Vulnerability Overview​

The vulnerabilities center around an Out-of-bounds Write issue classified as CWE-787. This specific flaw allows remote attackers to execute arbitrary code on the affected versions of Monitouch V-SFT, contingent upon user interaction. In other words, a user must visit a malicious webpage or open a harmful file for the exploit to be successful.
The vulnerabilities exist within the parsing of V10 and related files, where the software fails to validate the length of user-supplied data before copying it, resulting in unacceptable memory operations. This oversight effectively enables attackers to inject code into the stack.
Subcategories of this vulnerability have been catalogued under CVEs:

• CVE-2024-11787: CVSS v4 Score of 8.4
• CVE-2024-11789: CVSS v4 Score of 8.4
• CVE-2024-11790: CVSS v4 Score of 8.4
• CVE-2024-11791: CVSS v4 Score of 8.4
• CVE-2024-11792: CVSS v4 Score of 8.4
• CVE-2024-11793: CVSS v4 Score of 8.4
• CVE-2024-11794: CVSS v4 Score of 8.4
• CVE-2024-11795: CVSS v4 Score of 8.4
• CVE-2024-11796: CVSS v4 Score of 8.4
• CVE-2024-11797: CVSS v4 Score of 8.4

Notably, these vulnerabilities require a specific interaction from users and are not considered exploitable remotely without such actions.

3.3 Background​

Fuji Electric's Monitouch V-SFT software is utilized within critical manufacturing and energy sectors, making these vulnerabilities particularly concerning given the current climate of cyber threats against industrial control systems globally.

3.4 Researcher Credit​

The vulnerabilities were reported by a researcher identified as kimiya, who is affiliated with the Trend Micro Zero Day Initiative and subsequently communicated to CISA.

4. Mitigations​

In light of these vulnerabilities, Fuji Electric has announced plans to release a new version intended to resolve these issues, with a release date slated for April 2025. Until then, CISA recommends taking the following precautions:

1. Avoid unsolicited email: Do not click on links or open attachments in unsolicited email messages.
2. Enhance user awareness: Familiarize yourself with resources on recognizing and avoiding email scams and social engineering attacks.
3. Conduct proper analysis: Organizations should perform an impact analysis and comprehensive risk assessment before implementing any defensive measures.
4. Implement cybersecurity best practices: Follow CISA’s recommended practices found on their ICS webpage.

Despite the alarming nature of these vulnerabilities, CISA has reported that there have been no known public exploitations targeting these vulnerabilities as of now.

Organizations are encouraged to report any suspicious activities to CISA for monitoring and trend analysis.​

5. Update History​

The advisory was initially published on December 3, 2024, and users are encouraged to stay updated as further developments occur.

Conclusion​

With the significant reliance on industrial control systems for critical operations, it’s imperative for users and organizations utilizing Fuji Electric’s Monitouch V-SFT software to remain vigilant and implement the recommended security practices. Quick action can help mitigate risks associated with these vulnerabilities, safeguarding essential infrastructure from potential cyber threats.
Let’s use this advisory to reinforce our commitment to cybersecurity best practices. What measures have you implemented in your organization to safeguard against such vulnerabilities? Share your insights and experiences below.

---

Source: CISA Fuji Electric Monitouch V-SFT