Fuji Electric Tellus Lite V-Simulator

A local attacker with user-level access to a workstation running Tellus Lite V-Simulator could execute arbitrary code with the same permissions as the user, potentially compromising simulation integrity or using the compromised workstation as a pivot point to access plant networks.

Engineering and operations personnel at energy utilities who use Tellus Lite V-Simulator for control system modeling, simulation, and testing should prioritize this update. This affects workstations used for SCADA and DCS training, commissioning, and pre-deployment testing in generation, transmission, and distribution environments.

An attacker must have local access to a Windows workstation running Tellus Lite V-Simulator below version 4.0.20.0. The attacker exploits a buffer overflow or out-of-bounds memory write vulnerability to execute code during application runtime, requiring user interaction to trigger the vulnerable code path (such as opening a malicious project file or simulation data).