CVE-2025-47751: Fujielectric Monitouch V-sft RCE Flaw

CVE-2025-47751 Overview

CVE-2025-47751 is an out-of-bounds write vulnerability [CWE-787] in Fuji Electric V-SFT v6.2.5.0 and earlier. The flaw resides in the VS6EditData!CDataRomErrorCheck::MacroCommandCheck function. Opening a specially crafted V7 or V8 project file triggers the condition, leading to application crash, information disclosure, or arbitrary code execution. V-SFT is a configuration tool used to design screens for Fuji Electric Monitouch human-machine interface (HMI) panels, making this issue relevant to operational technology (OT) and industrial control system (ICS) environments.

Critical Impact

Successful exploitation can result in arbitrary code execution in the context of the V-SFT user, enabling tampering with HMI project files used on industrial Monitouch devices.

Affected Products

• Fuji Electric Monitouch V-SFT v6.2.5.0
• Fuji Electric Monitouch V-SFT versions earlier than v6.2.5.0
• V-SFT v6 project files of type V7 and V8

Discovery Timeline

• 2025-05-19 - CVE-2025-47751 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-47751

Vulnerability Analysis

The vulnerability is an out-of-bounds write inside the CDataRomErrorCheck::MacroCommandCheck routine within the VS6EditData module of V-SFT. When the application parses a V7 or V8 project file, malformed macro command data passes through the macro check logic without adequate boundary validation. The function then writes attacker-influenced data past the end of a destination buffer.

Memory adjacent to that buffer can include heap metadata, function pointers, or object virtual tables. Overwriting these structures lets an attacker corrupt control-flow data and divert execution. The defect requires user interaction: a victim must open a malicious file in V-SFT. Exploitation occurs locally, with the resulting code execution inheriting the privileges of the V-SFT user.

Root Cause

The root cause is missing bounds checking when MacroCommandCheck processes macro command records from a project file. The function trusts size and index values supplied by the file format, then writes beyond the bounds of a fixed-size buffer.

Attack Vector

The attack vector is local and file-based. An attacker crafts a malicious V7 or V8 project file and delivers it through email, removable media, shared engineering workstations, or supply chain handoffs. When an engineer opens the file in V-SFT, the parser triggers the out-of-bounds write. There is no network-facing attack surface, but ICS engineering workstations frequently exchange project files between integrators and asset owners, which increases delivery opportunities.

No public proof-of-concept exploit, ExploitDB entry, or CISA Known Exploited Vulnerabilities (KEV) listing currently exists for CVE-2025-47751. Refer to the JVN Security Vulnerability Notice for additional technical context.

Detection Methods for CVE-2025-47751

Indicators of Compromise

• Unexpected crashes of V-SFT.exe or related V-SFT v6 processes shortly after a V7 or V8 file is opened
• Windows Error Reporting (WER) entries referencing the VS6EditData module or CDataRomErrorCheck::MacroCommandCheck
• Newly received V7 or V8 project files from untrusted email, USB media, or external file shares on engineering workstations
• Child processes spawned by V-SFT.exe such as cmd.exe, powershell.exe, or rundll32.exe

Detection Strategies

• Hunt for process lineage where V-SFT.exe is the parent of any script interpreter or LOLBin
• Inspect file metadata of V7 and V8 project files for malformed macro command sections inconsistent with vendor-issued templates
• Correlate V-SFT crash events with subsequent suspicious process creation or outbound network connections from the engineering workstation

Monitoring Recommendations

• Centralize endpoint telemetry from ICS engineering workstations and alert on crashes within VS6EditData
• Track inbound V7 and V8 files at the email gateway and file-share boundary, and quarantine samples sourced from outside the engineering organization
• Review user execution of V-SFT against a defined list of authorized engineers and approved project file sources

How to Mitigate CVE-2025-47751

Immediate Actions Required

• Restrict V-SFT installations to authorized engineering workstations and remove the software from general-purpose hosts
• Only open V7 and V8 project files received from verified, trusted sources, and validate file integrity before opening
• Run V-SFT under a least-privileged Windows account to limit the impact of arbitrary code execution
• Segment ICS engineering workstations from the corporate network and the internet using firewall rules and jump hosts

Patch Information

Fuji Electric distributes V-SFT updates through the Monitouch download portal. Administrators should consult the Fuji Electric Monitouch Download portal and apply the fixed version published after v6.2.5.0. Review the JVN Security Vulnerability Notice for vendor-confirmed fixed versions and advisory updates.

Workarounds

• Block delivery of V7 and V8 project files from untrusted external senders at email and web gateways
• Open suspicious project files only inside an isolated virtual machine that has no access to production ICS networks
• Maintain application allow-listing on engineering workstations to prevent unauthorized child processes from launching after a V-SFT crash

# Example: block V7/V8 attachments from external senders on a mail gateway
# Adapt the rule syntax to your specific email security product
if sender.domain not in trusted_partners \
   and attachment.extension in ("v7", "v8"): 
    action: quarantine
    notify: ics-secops@example.com