CVE-2025-47750: Fujielectric Monitouch V-SFT RCE Flaw

CVE-2025-47750 Overview

CVE-2025-47750 is an out-of-bounds write vulnerability in Fuji Electric V-SFT v6.2.5.0 and earlier. The flaw resides in the VS6MemInIF!set_temp_type_default function. Opening a specially crafted V7 or V8 project file triggers the condition. Successful exploitation can lead to application crash, memory disclosure, or arbitrary code execution in the context of the user running V-SFT.

V-SFT is configuration software used to design screens for Fuji Electric Monitouch human-machine interface (HMI) devices. Engineering workstations running V-SFT are common targets in operational technology environments because they bridge IT and industrial control systems.

Critical Impact

An attacker who convinces an engineer to open a malicious V7 or V8 file gains arbitrary code execution on the engineering workstation, providing a foothold into HMI and process control networks.

Affected Products

• Fuji Electric Monitouch V-SFT v6.2.5.0
• Fuji Electric Monitouch V-SFT versions earlier than 6.2.5.0
• V7 and V8 project file parsers within V-SFT v6

Discovery Timeline

• 2025-05-19 - CVE-2025-47750 published to NVD
• 2025-05-19 - Last updated in NVD database

Technical Details for CVE-2025-47750

Vulnerability Analysis

The vulnerability is an out-of-bounds write categorized as [CWE-787]. It is reachable through the set_temp_type_default routine inside the VS6MemInIF module of V-SFT. When V-SFT parses a malformed V7 or V8 project file, the routine writes attacker-controlled data beyond the bounds of an allocated buffer.

Out-of-bounds writes corrupt adjacent memory structures, including heap metadata, function pointers, or object virtual tables. Attackers can shape the corruption to redirect execution flow and stage arbitrary code execution within the V-SFT process. The same primitive also enables information disclosure when residual heap contents are returned to controlled fields or trigger memory dumps during the crash path.

Exploitation requires local user interaction. A target must open the malicious project file in V-SFT, which is consistent with phishing-style delivery of weaponized engineering artifacts to control system operators.

Root Cause

The set_temp_type_default function in VS6MemInIF fails to validate a length or type field parsed from the V7 or V8 file before writing default values into a destination buffer. Without bounds checking, an oversized or unexpected value causes the write to extend past the allocated region.

Attack Vector

The attack vector is local with required user interaction. An attacker delivers a crafted V7 or V8 file through email, removable media, shared engineering repositories, or a compromised supplier. When the engineer opens the file, V-SFT parses the structure, triggers the out-of-bounds write, and executes attacker-controlled code with the privileges of the logged-on user.

No verified public proof-of-concept is available at the time of writing. Technical details are summarized in the JVN Security Advisory.

Detection Methods for CVE-2025-47750

Indicators of Compromise

• Unexpected V-SFT.exe crashes with access violations referencing VS6MemInIF.dll and set_temp_type_default
• V7 or V8 project files arriving from untrusted email senders, external drives, or unfamiliar shared folders
• Child processes spawned by V-SFT.exe such as cmd.exe, powershell.exe, or rundll32.exe
• Outbound network connections originating from V-SFT.exe to non-vendor infrastructure

Detection Strategies

• Hunt for Windows Error Reporting (WER) entries and crash dumps referencing the VS6MemInIF module on engineering workstations
• Monitor process creation events where V-SFT.exe is the parent of interactive shells or scripting engines
• Inspect inbound mail and file shares for V7 or V8 file extensions originating outside the engineering supply chain

Monitoring Recommendations

• Forward endpoint process, module-load, and crash telemetry from engineering hosts to a centralized data lake for retrospective analysis
• Alert on file writes that create V7 or V8 files in user download or temporary directories followed by execution of V-SFT.exe
• Track network egress from engineering workstations and flag connections to destinations not associated with Fuji Electric or approved integrators

How to Mitigate CVE-2025-47750

Immediate Actions Required

• Identify all engineering workstations running V-SFT v6 and inventory installed versions against 6.2.5.0
• Upgrade affected installations to the fixed release published on the Fuji Electric download page
• Restrict V-SFT execution to dedicated engineering hosts that are segmented from general corporate email and web browsing
• Block delivery of V7 and V8 file attachments through email gateways unless they originate from validated sources

Patch Information

Fuji Electric provides updated V-SFT v6 installers through the official Monitouch download portal. Administrators should retrieve the latest release from the Fuji Electric Download Page and validate file integrity against the vendor-published checksums. Additional advisory information is available in the JVN Security Advisory.

Workarounds

• Open V7 and V8 files only when received through trusted, verified channels
• Run V-SFT under a standard user account to limit the impact of code execution
• Use application allowlisting to prevent V-SFT from spawning command interpreters or scripting hosts
• Isolate engineering workstations on a dedicated VLAN with strict egress filtering

# Example: query installed V-SFT version on Windows engineering hosts
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "V-SFT"