Fuji Electric Monitouch V-SFT (Update A)

An attacker with local access to a Monitouch V-SFT workstation could execute arbitrary code with the privileges of the logged-in user, potentially allowing modification of project configurations or engineering data used to control energy infrastructure.

Energy sector operators (power utilities, generation plants) using Fuji Electric Monitouch V-SFT for SCADA/HMI engineering and configuration on workstations. Any user or contractor with physical or logical access to these workstations is an attack vector.

An attacker must have local access to a workstation running Monitouch V-SFT (version below 6.2.3.0). The vulnerabilities involve type casting errors (CWE-843) and buffer overflows (CWE-121) that could be triggered through user interaction—for example, opening a malicious project file or interacting with a compromised component. Once exploited, the attacker gains code execution in the context of the application.