PT-2023-7338 · Fuji Electric · Fuji Electric Tellus Lite V-Simulator

Fritz Sands + 1 · Published 2023-06-07 · Updated 2024-09-04 · CVE-2023-5299

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fuji Electric Tellus Lite V-Simulator (affected versions not specified)

Description The issue is related to inadequate access control in the Fuji Electric Tellus Lite V-Simulator, allowing an attacker to potentially execute arbitrary code. A user with a standard account in Fuji Electric Tellus Lite may overwrite files in the system, which could lead to further exploitation.

Recommendations For Fuji Electric Tellus Lite V-Simulator, consider restricting access to sensitive system files to prevent unauthorized modifications until a patch is available. As a temporary workaround, limit the privileges of standard accounts to minimize the risk of exploitation. Avoid using the vulnerable default permissions in Fuji Electric Tellus Lite until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-08369

CVE-2023-5299

ZDI-23-1730

Affected Products

Fuji Electric Tellus Lite V-Simulator

References · 8

• https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08369 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-5299 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-1730 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5299 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-CAN-21224 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-23-325-02 · Note
• https://t.me/cvenotify/61727 · Telegram Post