Fuji Electric HMI Configurator Flaws Expose Industrial Organizations to Hacking

Fuji Electric has patched several vulnerabilities in its V-SFT HMI configuration and development software, which is used to create and manage Monitouch HMIs across manufacturing and other industrial sectors. Cybersecurity researcher Michael Heinzl disclosed that the flaws could enable information disclosure or arbitrary code execution if a targeted user is lured into opening a malicious project file, granting the attacker control of the system with the victim’s privileges.

The issue stems from inadequate validation of user-supplied data, allowing a read past the end of an allocated data structure, per Heinzl in SecurityWeek. Fuji Electric released patches (version 6.2.9.0), and according to JPCERT’s advisory, organisations were informed about the vulnerabilities; JPCERT’s note, however, provides limited detail on potential impact.

The researcher stated it took the vendor roughly four months to release patches after notification, compared with about nine months for a previous batch of V-SFT vulnerabilities found by Heinzl. In total, more than 20 security holes discovered by Heinzl were patched in Fuji Electric’s HMI programmer in recent months.