JVNVU#93840158
Multiple vulnerabilities in FUJI ELECTRIC products

Overview

FUJI ELECTRIC TELLUS, TELLUS Lite, TELLUS Simulator, V-Server, and V-Server Lite contain multiple vulnerabilities.

Products Affected

CVE-2023-47580, CVE-2023-47581, CVE-2023-47582

• TELLUS V4.0.17.0 and earlier
• TELLUS Lite V4.0.17.0 and earlier

• TELLUS Simulator V4.0.17.0 and earlier

• V-Server V4.0.18.0 and earlier
• V-Server Lite V4.0.18.0 and earlier

Description

Multiple vulnerabilities listed below exist in the remote monitoring software 'TELLUS', 'TELLUS Lite', and 'TELLUS Simulator' and the simulator module and the remote monitoring software 'V-Server Lite' and 'V-Server' contained in the graphic editor 'V-SFT', provided by FUJI ELECTRIC CO., LTD.

• Improper restriction of operations within the bounds of a memory buffer in TELLUS, TELLUS Lite (CWE-119) - CVE-2023-47580

  CVSS v3

  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  Base Score: 7.8

• Out-of-bounds read in TELLUS, TELLUS Lite (CWE-125) - CVE-2023-47581

  CVSS v3

  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  Base Score: 7.8

• Access of uninitialized pointer in TELLUS, TELLLUS Lite (CWE-824) - CVE-2023-47582

  CVSS v3

  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  Base Score: 7.8

• Out-of-bounds read in TELLUS Simulator (CWE-125) - CVE-2023-47583

  CVSS v3

  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  Base Score: 7.8

• Out-of-bounds write in V-Server, V-Server Lite (CWE-787) - CVE-2023-47584

  CVSS v3

  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  Base Score: 7.8

• Out-of-bounds read in V-Server, V-Server Lite (CWE-125) - CVE-2023-47585

  CVSS v3

  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  Base Score: 7.8

• Heap-based buffer overflow in V-Server, V-Server Lite (CWE-122) - CVE-2023-47586

  CVSS v3

  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  Base Score: 7.8

Impact

If a user opens a specially crafted file, information may be disclosed and/or arbitrary code may be executed.

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.