CVE-2025-47754: Fujielectric Monitouch V-SFT RCE Flaw

CVE-2025-47754 Overview

CVE-2025-47754 is an out-of-bounds read vulnerability in Fuji Electric V-SFT v6.2.5.0 and earlier. The flaw resides in the VS6EditData!Conv_Macro_Data function within the V-SFT screen configuration software for Monitouch HMI devices. Attackers can trigger the issue by convincing a user to open a specially crafted V7 or V8 project file. Successful exploitation may lead to application crash, information disclosure, or arbitrary code execution in the context of the V-SFT user. The vulnerability is categorized as [CWE-125] Out-of-Bounds Read and affects engineering workstations used to program industrial HMI devices.

Critical Impact
Opening a malicious V7 or V8 file in V-SFT can lead to arbitrary code execution on the engineering workstation, potentially compromising industrial control system development environments.

Affected Products

Fuji Electric Monitouch V-SFT v6.2.5.0
Fuji Electric Monitouch V-SFT versions prior to v6.2.5.0
V-SFT v6 project files in V7 and V8 formats

Discovery Timeline

2025-05-19 - CVE-2025-47754 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47754

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the Conv_Macro_Data function exported from the VS6EditData module. V-SFT is the configuration tool used to design screens and macros for Fuji Electric Monitouch HMI panels. When the application parses a V7 or V8 project file, the macro data conversion routine reads memory beyond the bounds of an allocated buffer. The condition arises during deserialization of attacker-controlled fields embedded in the project file.

Depending on the heap layout at read time, the operation produces three distinct outcomes. The process can crash on an invalid memory access, leak adjacent process memory back into application logic, or feed corrupted data into downstream code paths that result in arbitrary code execution.

Root Cause

The root cause is insufficient bounds validation on length or offset fields parsed from V7 and V8 project files. The Conv_Macro_Data function trusts size or index values supplied by the file format without verifying they fall within the allocated buffer. This is consistent with [CWE-125] Out-of-Bounds Read patterns common in legacy parsers for binary engineering file formats.

Attack Vector

Exploitation requires local access and user interaction. An attacker must deliver a crafted V7 or V8 file to a victim and convince them to open it in V-SFT. Common delivery channels include email attachments, shared engineering project repositories, USB media, and supply chain compromise of third-party integrators. No authentication to the target system is required beyond the user's own access to V-SFT.

The vulnerability manifests during file parsing in VS6EditData!Conv_Macro_Data. Technical specifics of the crafted file structure are not published. Refer to the JVN Vulnerability Report for additional advisory details.

Detection Methods for CVE-2025-47754

Indicators of Compromise

Unexpected crashes of the V-SFT process (V-SFT.exe) shortly after opening a V7 or V8 file
Windows Error Reporting events referencing the VS6EditData module with access violation exceptions
V7 or V8 project files received from untrusted sources, particularly via email or external media
Child processes spawned from V-SFT.exe that are inconsistent with normal engineering workflows

Detection Strategies

Monitor process creation events where V-SFT.exe is the parent of command shells, scripting hosts, or LOLBins
Alert on application crash telemetry tagged to the VS6EditData module, which suggests parser failure
Inspect file shares and email gateways for V7 and V8 files originating outside the trusted engineering supply chain
Correlate file open events on V-SFT project files with subsequent anomalous outbound network activity

Monitoring Recommendations

Deploy endpoint behavioral monitoring on engineering workstations running V-SFT
Collect Windows Application and Security event logs from all hosts with V-SFT installed and forward them to a central data lake
Track installed V-SFT versions across the OT environment to identify hosts still running v6.2.5.0 or earlier
Baseline normal V-SFT file open patterns to detect anomalous bulk processing of project files

How to Mitigate CVE-2025-47754

Immediate Actions Required

Inventory all engineering workstations running V-SFT v6 and identify versions at or below v6.2.5.0
Apply the vendor update available from the Fujielectric Monitouch Download site
Restrict V-SFT usage to dedicated engineering workstations isolated from general user email and web browsing
Block inbound V7 and V8 file attachments from untrusted external sources at email and web gateways

Patch Information

Fuji Electric provides updated V-SFT v6 installers through the official Monitouch download portal. Administrators should download the latest release from the Fujielectric Monitouch Download page and verify the installed version exceeds v6.2.5.0 after deployment. Refer to the JVN Vulnerability Report for the vendor-coordinated advisory.

Workarounds

Only open V7 and V8 project files received from verified, trusted sources within the engineering supply chain
Use application allowlisting to restrict execution of binaries spawned from V-SFT.exe
Operate V-SFT under a standard user account rather than an administrative account to limit post-exploitation impact
Segment engineering workstations from corporate IT networks to reduce lateral movement risk after compromise

bash

# Inventory hosts running vulnerable V-SFT versions via PowerShell
Get-WmiObject -Class Win32_Product | \
  Where-Object { $_.Name -like '*V-SFT*' } | \
  Select-Object Name, Version, InstallDate