Monitouch V-SFT
CVE-2025-61860
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted V-SFT file to engineer
-
DeliveryVictim opens file in V-SFT ≤6.2.7.0
-
ExploitOut-of-bounds read in set_temp_type_default
-
ExecutionMemory disclosure or code execution on workstation
-
ImpactCompromise of OT engineering host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a local user to open a specially crafted V-SFT project file in Fuji Electric Monitouch V-SFT version 6.2.7.0 or earlier; there is no remote, network-triggered path (AV:L). The vulnerable code path is the set_temp_type_default function in the VS6MemInIF component invoked during file parsing. Key limiting factors: mandatory user interaction (the victim must be socially engineered into opening the malicious file), local delivery of the file to an engineering workstation running the affected desktop tool, and the affected version range - up-to-date installations past 6.2.7.0 are not affected. No special product configuration or authentication is required beyond having the software installed and opening the file. |
| Impact | This is a client-side file-parsing flaw (CWE-125 out-of-bounds read) in Fuji Electric's Monitouch V-SFT HMI configuration software, not a remotely reachable service bug. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H) scores 8.4 largely because it credits high confidentiality, integrity and availability impact - consistent with the description's claim of information disclosure, abnormal termination (ABEND) and arbitrary code execution. However, the vector requires local attack vector and user interaction (UI:A): a victim must be induced to open a malicious .V-SFT file, so there is no network-facing exposure despite the high numeric score. Real-world urgency signals are low and mutually consistent: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code is referenced. The AV:L + UI:A profile combined with an out-of-bounds READ primitive also makes the claimed 'arbitrary code execution' outcome aspirational rather than demonstrated - OOB reads more reliably yield info disclosure or crashes than reliable RCE. Net: a genuinely high-impact-if-exploited bug but low immediate priority for most organizations, warranting patching in a normal cycle rather than emergency response. This should be treated as a targeted/social-engineering risk against engineering workstations, not a wormable or mass-exploitable issue. |
| Exploit ScenarioDerived | An attacker crafts a malicious V-SFT project file and delivers it to an HMI engineer or integrator (e.g., via email, a shared project repository, or a compromised vendor drop) under a plausible pretext. When the engineer opens the file in V-SFT v6.2.7.0 or earlier, the set_temp_type_default routine reads out of bounds, leaking memory contents, crashing the application, or potentially executing attacker-controlled code on the engineering workstation. No public exploit code is referenced, and successful exploitation depends on the local user opening the crafted file (CVSS UI:A, AV:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
An out-of-bounds read in Fuji Electric's Monitouch V-SFT HMI configuration software (version 6.2.7.0 and earlier) allows a local attacker to trigger information disclosure, abnormal termination, and potentially arbitrary code execution by convincing a user to open a specially crafted project file. The vulnerability resides in the VS6MemInIF!set_temp_type_default function and requires user interaction to open the malicious file. No public exploit code has been identified, and the EPSS score is low (0.18%), but the potential impact on confidentiality, integrity, and availability is high.
RemediationAI
Apply the vendor's patch by upgrading to a version later than 6.2.7.0 as indicated in the Fuji Electric advisory (https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php) and the JVN advisory (https://jvn.jp/en/vu/JVNVU90008453/). Because the vulnerability requires a user to open a malicious file, mitigate risk by educating users not to open V-SFT project files from untrusted sources, using email and web gateways to block V-SFT file attachments from external parties, and running the software with least privilege to limit the impact of a successful exploit. Disabling the preview or auto-open features for project files, if available, can reduce the attack surface but may impact workflow. No network-level mitigation is applicable since the attack is local.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Monitouch V-SFT is a Windows-based engineering tool used to create and edit HMI screens for Fuji Electric's Monitouch series of programmable displays. The vulnerability is an out-of-bounds read (CWE-125) in the VS6MemInIF module, specifically in the set_temp_type_default function, which is invoked during the parsing of V-SFT project files. When a specially crafted file is opened, the software may read beyond the allocated buffer, leading to memory corruption that can result in information disclosure, a crash (ABEND), or potentially arbitrary code execution. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) and the assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) both confirm that exploitation requires local access and active user interaction to open the malicious file; there is no remote network vector. The affected product is identified by CPE as Fuji Electric Monitouch V-SFT.
Know when Monitouch V Sft gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
File must be opened locally by a user, so AV:L and UI:R with PR:N; parsing flaw yields disclosure, crash and potential code execution, giving C:H/I:H/A:H and unchanged scope.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
DescriptionCVE.org
An out-of-bounds read vulnerability exists in VS6MemInIF!set_temp_type_default of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
Executive ViewAI
Fuji Electric's Monitouch V-SFT HMI configuration software, used to engineer and maintain operator interface panels across industrial control environments, contains a high-severity memory handling flaw that a local attacker could leverage if an engineer opens a tampered project file. Because these workstations typically sit inside or adjacent to operational technology networks and hold credentials and logic for plant-floor HMIs, a successful compromise could disrupt monitoring and control of physical processes in addition to exposing sensitive engineering data. Leadership should care because the affected tooling is embedded in operational workflows where a single malicious file, delivered by email or removable media, could translate into downtime, safety exposure, and integrity loss on production systems.
No vendor-released patch identified at time of analysis. Interim mitigations: prohibit opening project files from untrusted or external sources; quarantine and integrity-check all project files before engineering use; limit local access to Monitouch V-SFT workstations to authorized personnel; segment HMI engineering hosts from production and corporate networks; maintain offline backups of project files and configurations; monitor for unexpected process termination or anomalous memory access in the VS6MemInIF component; leverage Windows exploit protection features (e.g., DEP/CFG) and application allowlisting to constrain code execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Monitouch V Sft
View allA Heap-Based Buffer Overflow was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. Rated h
A Stack-Based Buffer Overflow issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0.
Fuji Electric Monitouch V-SFT is vulnerable to a type confusion, which could cause a crash or code execution. Rated high
Fuji Electric Monitouch V-SFT is vulnerable to an out-of-bounds write because of a type confusion, which could result in
Fuji Electric Monitouch V-SFT is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute a
Stack-based buffer overflow in Fuji Electric's Monitouch V-SFT HMI configuration software (v6.2.7.0 and earlier) lets an
Out-of-bounds write in Fuji Electric V-SFT 6.2.7.0 and earlier can let a crafted V-SFT project file cause information di
Opening a specially crafted V-SFT project file in Fuji Electric Monitouch V-SFT 6.2.7.0 and earlier can trigger an out-o
Out-of-bounds write in Fuji Electric's MONITOUCH V-SFT HMI configuration tool (v6.2.7.0 and earlier) allows an attacker
Use-after-free memory corruption in Fuji Electric's Monitouch V-SFT engineering software (v6.2.7.0 and earlier) allows a
Opening a specially crafted V-SFT project file in Fuji Electric Monitouch V-SFT 6.2.7.0 or earlier can trigger an out-of
Arbitrary code execution and information disclosure in Fuji Electric Monitouch V-SFT 6.2.7.0 and earlier can be triggere
GitHub PoC
Exploit-DB