CVE-2025-50130
BaseFortify
Publication date: 2025-07-08
Last updated on: 2025-07-08
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a heap-based buffer overflow in the VS6Sim.exe component of Fuji Electric's V-SFT and TELLUS software. It occurs when the software opens specially crafted V9 or X1 files created by an attacker, which can lead to arbitrary code execution on the affected system. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to execute arbitrary code on your system with the privileges of the affected software. This could lead to unauthorized control, data compromise, or disruption of system operations. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying the presence of affected versions of V-SFT (version 6.2.5.0 and earlier) or TELLUS (version 4.0.20.0 and earlier) software on your system. Since the vulnerability is triggered by opening specially crafted V9 or X1 files in VS6Sim.exe, monitoring for such file usage or suspicious file activity related to these file types may help. However, no specific detection commands or network signatures are provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate recommended step to mitigate this vulnerability is to update the affected software (V-SFT and TELLUS) to the latest versions provided by Fuji Electric, as these updates address the heap-based buffer overflow issue. Avoid opening untrusted or suspicious V9 or X1 files with the affected software until the update is applied. [1]