CVE-2024-37029: Fujielectric Tellus Lite Buffer Overflow

CVE-2024-37029 Overview

CVE-2024-37029 is a stack-based buffer overflow [CWE-121] in Fuji Electric Tellus Lite V-Simulator, a human-machine interface (HMI) simulator used in industrial control system (ICS) environments. An attacker can trigger the overflow by convincing a local user to open a crafted project file. Successful exploitation allows arbitrary code execution in the context of the current user. The flaw was documented in CISA ICS Advisory ICSA-24-165-14 and affects operational technology (OT) engineering workstations.

Critical Impact
Local arbitrary code execution on ICS engineering workstations running Fuji Electric Tellus Lite V-Simulator through malicious project files.

Affected Products

Fuji Electric Tellus Lite V-Simulator
ICS engineering workstations running the V-Simulator component
Windows hosts used to import untrusted Tellus project files

Discovery Timeline

2024-06-13 - CVE-2024-37029 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37029

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow classified under [CWE-121]. The Tellus Lite V-Simulator parses project or configuration files without adequately validating the length of input fields before copying them onto the stack. When a crafted file supplies more data than the destination stack buffer can hold, adjacent memory is overwritten, including the saved return address.

An attacker who controls the return address or structured exception handling records can redirect execution to attacker-supplied shellcode or a return-oriented programming (ROP) chain. Exploitation requires user interaction because the target must open the malicious file. The attack vector is local, but delivery through phishing or shared engineering repositories is realistic in ICS environments.

Because the affected software runs on engineering workstations, code execution typically inherits the privileges of the ICS engineer. That access can be leveraged to pivot into supervisory systems, tamper with HMI logic, or stage further intrusion into the control network.

Root Cause

The root cause is missing bounds checking during file parsing. Fixed-size stack buffers receive attacker-controlled data from a project file without a length check, permitting classic stack corruption.

Attack Vector

An attacker crafts a malicious Tellus project file and delivers it to an operator through email, removable media, or a shared network location. When the file is opened in V-Simulator, the parser overflows the stack buffer and executes attacker code. See the CISA ICS Advisory ICSA-24-165-14 for vendor-supplied technical details.

// No verified public proof-of-concept is available.
// Refer to CISA ICSA-24-165-14 for vendor technical details.

Detection Methods for CVE-2024-37029

Indicators of Compromise

Unexpected child processes spawned by the Tellus Lite V-Simulator executable, such as cmd.exe, powershell.exe, or rundll32.exe.
Crashes or Windows Error Reporting (WerFault.exe) events referencing the V-Simulator process shortly after opening a project file.
Tellus project files arriving from untrusted email, USB media, or non-standard network shares on engineering workstations.

Detection Strategies

Monitor process lineage on ICS engineering workstations for the V-Simulator process launching interpreters, script hosts, or network utilities.
Alert on stack execution or exception-handler overwrite indicators generated by exploit mitigation tooling (DEP, ASLR, CFG) on hosts running Tellus Lite.
Inspect newly introduced Tellus project files with file integrity monitoring and endpoint telemetry to identify anomalous file sizes or structures.

Monitoring Recommendations

Forward endpoint telemetry from OT engineering workstations to a centralized SIEM or data lake for correlation with ICS network events.
Track user-initiated file open events for Tellus file extensions and correlate with subsequent process creation and network activity.
Baseline normal V-Simulator behavior and alert on deviations such as outbound connections, credential access, or persistence attempts.

How to Mitigate CVE-2024-37029

Immediate Actions Required

Apply the vendor-supplied update referenced in CISA ICS Advisory ICSA-24-165-14 to all systems running Tellus Lite V-Simulator.
Restrict the opening of Tellus project files to trusted sources and validated internal repositories only.
Segment engineering workstations from business networks and the internet to limit delivery of malicious files.

Patch Information

Refer to CISA ICS Advisory ICSA-24-165-14 for Fuji Electric's remediation guidance and fixed versions of Tellus Lite V-Simulator. No separate vendor advisory URL is listed in the CVE record beyond the CISA reference.

Workarounds

Do not open Tellus project files received from untrusted sources or unsolicited email attachments.
Enforce application allowlisting so that only signed, expected binaries execute on ICS engineering workstations.
Enable Windows exploit protection features such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) on hosts running V-Simulator.
Remove Tellus Lite V-Simulator from workstations where it is not actively required for engineering tasks.

bash

# Example: enforce DEP for all processes on a Windows engineering workstation
bcdedit /set {current} nx AlwaysOn