CVE-2024-37022: Fujielectric Tellus Lite V-Simulator RCE

CVE-2024-37022 Overview

CVE-2024-37022 is an out-of-bounds write vulnerability in Fuji Electric Tellus Lite V-Simulator, a human-machine interface (HMI) simulation tool used in industrial control system (ICS) environments. An attacker who convinces a local user to open a crafted project file can manipulate memory outside the intended buffer boundary. Successful exploitation results in arbitrary code execution in the context of the user running the application.

The issue is tracked under [CWE-787] (Out-of-bounds Write) and was published in the CISA ICS advisory catalog. The vulnerability carries a CVSS v4.0 base score of 8.5.

Critical Impact
Attackers can execute arbitrary code on operator workstations running Tellus Lite V-Simulator by delivering a malicious project file, threatening the integrity of ICS engineering assets.

Affected Products

Fuji Electric Tellus Lite V-Simulator
ICS engineering workstations running vulnerable Tellus Lite builds
Windows hosts used for HMI project development and simulation

Discovery Timeline

2024-06-13 - CVE-2024-37022 published to NVD
2024-06-13 - CISA publishes advisory ICSA-24-165-14
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37022

Vulnerability Analysis

Tellus Lite V-Simulator parses proprietary project and configuration files used to model HMI screens. During this parsing, the application writes attacker-controlled data past the end of an allocated buffer. The out-of-bounds write corrupts adjacent memory structures, including function pointers or return addresses on the stack or heap.

Exploitation requires local access and user interaction. An operator or engineer must open a malicious file for the exploit to trigger. Once triggered, the attacker gains code execution at the privilege level of the interactive user, which on engineering workstations often includes access to production HMI projects.

Root Cause

The root cause is missing or insufficient bounds checking when copying externally supplied field values from a project file into an internal buffer. The parser trusts length or index values embedded in the file without validating them against the destination buffer size, permitting a write beyond allocated memory.

Attack Vector

The attack vector is local file-based delivery. An attacker crafts a malformed Tellus project or simulator file and delivers it through phishing email, removable media, a shared engineering repository, or a compromised supplier. When the target opens the file in Tellus Lite V-Simulator, the parser triggers the out-of-bounds write and executes attacker-supplied shellcode.

No public proof-of-concept exploit is listed for this CVE. Refer to the CISA ICS Advisory ICSA-24-165-14 for vendor technical details.

Detection Methods for CVE-2024-37022

Indicators of Compromise

Unexpected child processes spawned by the Tellus Lite V-Simulator executable, particularly cmd.exe, powershell.exe, or rundll32.exe.
Tellus Lite process crashes or Windows Error Reporting entries referencing access violations during project file loading.
Project files arriving from external senders or non-standard shares immediately before a crash or suspicious process activity.

Detection Strategies

Monitor process lineage on engineering workstations and alert when Tellus Lite V-Simulator spawns interpreters, script hosts, or network utilities.
Enable Windows Defender Exploit Guard and Attack Surface Reduction (ASR) rules to log memory corruption events in the Tellus process.
Ingest Sysmon Event IDs 1, 7, and 11 from ICS workstations to capture module loads and file writes that correlate with project file parsing.

Monitoring Recommendations

Baseline expected file paths, extensions, and network origins for legitimate Tellus project files and alert on deviations.
Track application crash telemetry from ICS engineering hosts and correlate with file-open events for early detection of exploitation attempts.
Audit removable media and email attachments delivered to operators for Tellus-associated file types.

How to Mitigate CVE-2024-37022

Immediate Actions Required

Apply the fixed version of Tellus Lite V-Simulator as directed in CISA ICSA-24-165-14.
Restrict Tellus Lite V-Simulator to dedicated engineering workstations and remove it from general-purpose endpoints.
Block untrusted Tellus project files at the email gateway and on removable media control policies.

Patch Information

Fuji Electric addressed the vulnerability in an updated release of Tellus Lite V-Simulator. Consult CISA ICS Advisory ICSA-24-165-14 for the exact fixed version and vendor download instructions.

Workarounds

Operate Tellus Lite V-Simulator under a standard user account without local administrator privileges to limit post-exploitation impact.
Segment ICS engineering workstations from corporate networks and the internet, following [ISA/IEC 62443] zone and conduit guidance.
Enable Windows Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) system-wide to raise the cost of memory corruption exploits.
Train operators and engineers to validate the origin of project files before opening them in the simulator.

bash

# Example: enforce ASR rule blocking Office/child-process abuse patterns on ICS workstations
Set-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a `
                 -AttackSurfaceReductionRules_Actions Enabled

# Example: restrict interactive logon on engineering hosts to authorized ICS engineers
secedit /export /cfg C:\policy.inf
# Edit SeInteractiveLogonRight to include only the ICS-Engineers group, then reapply:
secedit /configure /db secedit.sdb /cfg C:\policy.inf