CVE-2025-50130

A heap-based buffer overflow vulnerability exists in VS6Sim.exe contained in V-SFT and TELLUS provided by FUJI ELECTRIC CO., LTD. Opening V9 files or X1 files specially crafted by an attacker on the affected product may lead to arbitrary code execution.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://jvn.jp/en/vu/JVNVU94011267/
https://monitouch.fujielectric.com/site/download-e/03tellus_inf/Search.php
https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de desbordamiento de búfer en el montón en VS6Sim.exe, incluido en V-SFT y TELLUS, proporcionados por FUJI ELECTRIC CO., LTD. Abrir archivos V9 o X1 especialmente manipulados por un atacante en el producto afectado puede provocar la ejecución de código arbitrario.

08 Jul 2025, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-08 13:15

Updated : 2026-06-17 09:34

NVD link : CVE-2025-50130

Mitre link : CVE-2025-50130

CVE.ORG link : CVE-2025-50130

JSON object : View

Products Affected

No product.

CWE

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2025-50130", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-50130", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-07-08T13:33:13.788717Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vultures@jpcert.or.jp", "affectedData": [{"vendor": "FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd.", "product": "V-SFT-6", "versions": [{"status": "affected", "version": "v6.2.5.0 and earlier"}]}, {"vendor": "FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd.", "product": "TELLUS", "versions": [{"status": "affected", "version": "v4.0.20.0 and earlier"}]}]}], "published": "2025-07-08T13:15:33.710", "references": [{"url": "https://jvn.jp/en/vu/JVNVU94011267/", "source": "vultures@jpcert.or.jp"}, {"url": "https://monitouch.fujielectric.com/site/download-e/03tellus_inf/Search.php", "source": "vultures@jpcert.or.jp"}, {"url": "https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php", "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow vulnerability exists in VS6Sim.exe contained in V-SFT and TELLUS provided by FUJI ELECTRIC CO., LTD.\r\nOpening V9 files or X1 files specially crafted by an attacker on the affected product may lead to arbitrary code execution."}, {"lang": "es", "value": "Existe una vulnerabilidad de desbordamiento de b\u00fafer en el mont\u00f3n en VS6Sim.exe, incluido en V-SFT y TELLUS, proporcionados por FUJI ELECTRIC CO., LTD. Abrir archivos V9 o X1 especialmente manipulados por un atacante en el producto afectado puede provocar la ejecuci\u00f3n de c\u00f3digo arbitrario."}], "lastModified": "2026-06-17T09:34:41.433", "sourceIdentifier": "vultures@jpcert.or.jp"}