CVE-2024-11802

Executive Summary

CVE-2024-11802 is a critical stack-based buffer overflow vulnerability in Fuji Electric Tellus Lite V-Simulator 5, specifically during the parsing of V8 files. The flaw allows remote attackers to execute arbitrary code in the context of the current process, but requires user interaction (opening a malicious file or visiting a malicious page). With a CVSS score of 7.8, this vulnerability poses a significant risk to industrial control system (ICS) environments where Tellus Lite is used for HMI simulation and configuration. No public exploit code or patch details are currently available, making proactive detection and mitigation essential.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Local (requires user to open a malicious file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. Although user interaction is required, the vulnerability can be triggered via phishing or social engineering, leading to full system compromise in an ICS context.

Deep Dive & Mechanics

The vulnerability resides in the V-Simulator 5 component of Fuji Electric Tellus Lite, which parses V8 files (proprietary simulation files). The specific flaw is a classic stack-based buffer overflow (CWE-121). When the application reads user-supplied data from a V8 file, it fails to validate the length of the data before copying it to a fixed-length stack buffer using a function like strcpy or memcpy. An attacker can craft a V8 file with an oversized field, causing the buffer to overflow and overwrite the return address or other critical stack data. This allows arbitrary code execution in the context of the Tellus Lite process.

The vulnerability was reported via ZDI-CAN-24770, indicating it was responsibly disclosed to the vendor. However, no patch has been confirmed, and the EPSS score is 0.0%, suggesting low exploitation activity in the wild as of the report date.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison cannot be made. However, based on the CWE-121 description, the vulnerable code likely resembles:

void parse_v8_field(char *input) {
    char buffer[256];
    strcpy(buffer, input); // No length check
}

A patched version would include bounds checking:

void parse_v8_field(char *input) {
    char buffer[256];
    strncpy(buffer, input, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Fuji Electric Tellus Lite V-Simulator 5 installed on a Windows target.
• Ability to deliver a malicious V8 file (e.g., via email, USB, or web download).

Exploitation Steps:

1. Craft a V8 file with an oversized field in a vulnerable parser path.
2. Use a tool like pattern_create.rb (from Metasploit) to generate a cyclic pattern to determine the offset to the return address.
3. Overwrite the return address with a ROP chain or shellcode address.
4. Deliver the file to the target and convince the user to open it.
5. Upon execution, the overflow triggers arbitrary code execution.

Example (Conceptual):

# Python script to generate a malicious V8 file
buffer = b"A" * 260  # Offset to return address
buffer += b"\x90" * 16  # NOP sled
buffer += shellcode  # e.g., calc.exe or reverse shell
with open("malicious.v8", "wb") as f:
    f.write(buffer)

Blue Team

Detection:

• Monitor for unusual V8 file sizes or patterns.
• Use process monitoring tools (e.g., Sysmon) to detect Tellus Lite crashes or abnormal memory access.
• Deploy endpoint detection rules for stack-based overflow indicators.

Hunting:

• Search for V8 files with unusually large fields or non-standard structures.
• Correlate with user activity logs for file opens from untrusted sources.

Indicators of Compromise (IOCs)

• File Hashes: (No known samples yet)
• Network Indicators: Outbound connections from Tellus Lite process to attacker-controlled IPs.
• Process Anomalies: Tellus Lite process (e.g., VSimulator5.exe) crashing or exhibiting high CPU/memory usage.
• Registry/File System: Modified V8 files in %APPDATA%\Fuji Electric\Tellus Lite\ or similar paths.

Detection Engineering

YARA Rule

rule CVE_2024_11802_V8_Overflow {
    meta:
        description = "Detects malicious V8 files exploiting CVE-2024-11802"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11802"
    strings:
        $magic = { 56 38 00 } // "V8\0" header
        $overflow = { 41 41 41 41 } // Pattern of 'AAAA' indicating overflow
    condition:
        $magic at 0 and #overflow > 10
}

Sigma Rule

title: Fuji Electric Tellus Lite V8 File Overflow
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2024-11802 via V8 file parsing
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\VSimulator5.exe'
        CommandLine|contains: '.v8'
    condition: selection
falsepositives:
    - Legitimate V8 file usage
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-11802 Fuji Electric Tellus Lite V8 Overflow"; flow:to_server,established; content:"|56 38|"; offset:0; depth:2; content:"|41 41 41 41|"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable or restrict access to Tellus Lite V-Simulator 5 until a patch is available.
• User Training: Educate users not to open V8 files from untrusted sources.
• Network Segmentation: Isolate ICS networks from corporate and internet access.
• Application Whitelisting: Allow only trusted V8 files via AppLocker or similar.
• Monitor: Deploy the YARA/Sigma/Suricata rules above to detect exploitation attempts.
• Vendor Contact: Monitor Fuji Electric’s security advisories for patch releases.

Valters IT