CVE-2024-11795

Executive Summary

CVE-2024-11795 is a stack-based buffer overflow vulnerability in Fuji Electric Monitouch V-SFT, specifically during the parsing of V8 files. The flaw allows remote code execution (RCE) in the context of the current process, requiring user interaction (e.g., opening a malicious file or visiting a malicious page). With a CVSS score of 7.8, this vulnerability poses a high risk to industrial control systems (ICS) environments where Monitouch V-SFT is used for HMI configuration. No public exploit or patch is currently available, but the vulnerability is weaponizable via crafted V8 files.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Attack Vector: Local (requires user interaction)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High – Exploitation can lead to full system compromise within the HMI environment, potentially disrupting industrial processes.

Deep Dive & Mechanics

The vulnerability resides in the V8 file parsing routine of Fuji Electric Monitouch V-SFT. When the application reads a specially crafted V8 file, it fails to validate the length of user-supplied data before copying it to a stack-based buffer. This results in a classic stack buffer overflow (CWE-121), allowing an attacker to overwrite the return address and control program flow. Since the application runs with user privileges, successful exploitation grants code execution at the same privilege level, enabling further lateral movement or data exfiltration.

Root Cause: Lack of bounds checking in the memcpy or similar function used during V8 file parsing.

Vulnerable vs. Patched Code

No official patch is available. The vulnerable code likely resembles:

void parse_v8_file(char *data) {
    char buffer[256];
    // No length check
    strcpy(buffer, data);  // Vulnerable
}

A patched version would include bounds checking:

void parse_v8_file(char *data, size_t len) {
    char buffer[256];
    if (len >= sizeof(buffer)) {
        // Handle error
        return;
    }
    memcpy(buffer, data, len);  // Safe
}

Exploitation & Lab Setup

Red Team

Lab Setup:

• Windows 10/11 VM with Fuji Electric Monitouch V-SFT installed.
• Python 3 for crafting malicious V8 files.

Exploit Concept:
Since no public exploit exists, a custom exploit would involve:

1. Crafting a V8 file with a payload that overflows the stack buffer.
2. Using a ROP chain to bypass DEP/ASLR (if enabled).
3. Executing shellcode to spawn a reverse shell or execute arbitrary commands.

Example Payload Structure (pseudo-code):

payload = b"A" * 256  # Fill buffer
payload += b"BBBB"    # Overwrite EBP
payload += b"CCCC"    # Overwrite return address (ROP gadget)
payload += shellcode

Delivery: Phishing email with malicious V8 attachment or hosted on a malicious site.

Blue Team

Detection:

• Monitor for unusual V8 file access or parsing errors.
• Use YARA rules to scan for malicious V8 files.
• Enable application whitelisting to block untrusted executables.

Mitigation:

• Restrict user permissions to prevent exploitation.
• Use endpoint detection and response (EDR) to monitor for buffer overflow behavior.
• Apply virtual patching via IDS/IPS if possible.

Indicators of Compromise (IOCs)

• File Hashes: (None available; monitor for suspicious V8 files)
• Network: Outbound connections from Monitouch V-SFT process to unknown IPs.
• Process: V-SFT.exe or related process crashing or exhibiting abnormal memory access.
• Registry: Unauthorized modifications to HKEY_CURRENT_USER\Software\Fuji Electric.

Detection Engineering

YARA Rule

rule CVE_2024_11795_V8_Overflow {
    meta:
        description = "Detects malicious V8 files exploiting CVE-2024-11795"
        author = "Valters IT"
        date = "2025-04-01"
    strings:
        $s1 = "V8" ascii wide nocase
        $s2 = { 41 41 41 41 } // Pattern of overflow (AAAA)
    condition:
        $s1 at 0 and #s2 > 10
}

Sigma Rule

title: CVE-2024-11795 Stack Buffer Overflow in Fuji Electric Monitouch V-SFT
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2024-11795 via abnormal V8 file parsing
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: 'V-SFT.exe'
        CommandLine|contains: '.v8'
    condition: selection
falsepositives:
    - Legitimate V8 file usage
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-11795 Fuji Electric V-SFT V8 Overflow"; flow:to_server,established; content:"V8"; offset:0; depth:2; content:"|41 41 41 41|"; distance:0; within:256; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable V8 file parsing if not required. Restrict user interaction with untrusted files.
• Short-term: Monitor vendor advisories for patches. Implement application whitelisting.
• Long-term: Upgrade to a patched version once released. Conduct security training to avoid phishing attacks.
• Compensating Controls: Use host-based intrusion prevention (HIPS) to block buffer overflow attempts.

Valters IT
Securing Industrial Environments