jvndb-2024-013702
Vulnerability from jvndb
Published
2024-11-29 14:42
Modified
2024-11-29 14:42
Severity ?
7.8 (High) - cvssV3_0 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Multiple vulnerabilities in FUJI ELECTRIC products
Details
Multiple vulnerabilities listed below exist in the remote monitoring software 'TELLUS' and 'TELLUS Lite', and the simulator module and the remote monitoring software 'V-Server' and 'V-Server Lite' contained in the graphic editor 'V-SFT' provided by FUJI ELECTRIC CO., LTD. * Multiple Stack-based buffer overflow vulnerabilities in V-SFT, TELLUS, TELLLUS Lite (CWE-121) - CVE-2024-38309 * Out-of-bounds read vulnerability in TELLUS and TELLUS Lite (CWE-125) - CVE-2024-38389 * Out-of-bounds read vulnerability in V-Server and V-Server Lite (CWE-125) - CVE-2024-38658 Michael Heinzl reported these vulnerabilities to JPCERT/CC. JPCERT/CC coordinated with the developer.
References
JVN https://jvn.jp/en/vu/JVNVU97531313/index.html
CVE https://www.cve.org/CVERecord?id=CVE-2024-38309
CVE https://www.cve.org/CVERecord?id=CVE-2024-38389
CVE https://www.cve.org/CVERecord?id=CVE-2024-38658
Stack-based Buffer Overflow(CWE-121) https://cwe.mitre.org/data/definitions/121.html
Out-of-bounds Read(CWE-125) https://cwe.mitre.org/data/definitions/125.html
Impacted products
Fuji Electric Co., Ltd.TELLUS
Fuji Electric Co., Ltd.TELLUS Lite
Fuji Electric Co., Ltd.V-Server
Fuji Electric Co., Ltd.V-Server Lite
Fuji Electric Co., Ltd.V-SFT
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-013702.html",
  "dc:date": "2024-11-29T14:42+09:00",
  "dcterms:issued": "2024-11-29T14:42+09:00",
  "dcterms:modified": "2024-11-29T14:42+09:00",
  "description": "Multiple vulnerabilities listed below exist in the remote monitoring software \u0027TELLUS\u0027 and \u0027TELLUS Lite\u0027, and the simulator module and the remote monitoring software \u0027V-Server\u0027 and \u0027V-Server Lite\u0027 contained in the graphic editor \u0027V-SFT\u0027 provided by FUJI ELECTRIC CO., LTD.\r\n\r\n  * Multiple Stack-based buffer overflow vulnerabilities in V-SFT, TELLUS, TELLLUS Lite (CWE-121) - CVE-2024-38309\r\n  * Out-of-bounds read vulnerability in TELLUS and TELLUS Lite (CWE-125) - CVE-2024-38389\r\n  * Out-of-bounds read vulnerability in V-Server and V-Server Lite (CWE-125) - CVE-2024-38658\r\n\r\nMichael Heinzl reported these vulnerabilities to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-013702.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:fujielectric:tellus",
      "@product": "TELLUS",
      "@vendor": "Fuji Electric Co., Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:fujielectric:tellus_lite",
      "@product": "TELLUS Lite",
      "@vendor": "Fuji Electric Co., Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:fujielectric:v-server",
      "@product": "V-Server",
      "@vendor": "Fuji Electric Co., Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:fujielectric:v-server_lite",
      "@product": "V-Server Lite",
      "@vendor": "Fuji Electric Co., Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:fujielectric:v-sft",
      "@product": "V-SFT",
      "@vendor": "Fuji Electric Co., Ltd.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "7.8",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-013702",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU97531313/index.html",
      "@id": "JVNVU#97531313",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-38309",
      "@id": "CVE-2024-38309",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-38389",
      "@id": "CVE-2024-38389",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-38658",
      "@id": "CVE-2024-38658",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/121.html",
      "@id": "CWE-121",
      "@title": "Stack-based Buffer Overflow(CWE-121)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/125.html",
      "@id": "CWE-125",
      "@title": "Out-of-bounds Read(CWE-125)"
    }
  ],
  "title": "Multiple vulnerabilities in FUJI ELECTRIC products"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.