Sign-up

ID

VAR-202311-1677


CVE

CVE-2023-5299


TITLE

Fuji Electric's  Tellus Lite V-Simulator  Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2023-018322

DESCRIPTION

A user with a standard account in Fuji Electric Tellus Lite may overwrite files in the system. Fuji Electric's Tellus Lite V-Simulator Exists in unspecified vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the product installer. The issue results from incorrect permissions set on product folders created by the installer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of any user of the software. It is primarily used to collect real-time data from devices such as PLCs (Programmable Logic Controllers), temperature controllers, and inverters. Detailed vulnerability information is not currently available

Trust: 2.88

sources: NVD: CVE-2023-5299 // JVNDB: JVNDB-2023-018322 // ZDI: ZDI-23-1730 // CNVD: CNVD-2025-24578 // VULMON: CVE-2023-5299

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-24578

AFFECTED PRODUCTS

vendor:fujielectricmodel:tellus lite v-simulatorscope:ltversion:4.0.19.0

Trust: 1.0

vendor:富士電機model:tellus lite v-simulatorscope: - version: -

Trust: 0.8

vendor:富士電機model:tellus lite v-simulatorscope:eqversion: -

Trust: 0.8

vendor:富士電機model:tellus lite v-simulatorscope:eqversion:4.0.19.0

Trust: 0.8

vendor:fuji electricmodel:tellus litescope: - version: -

Trust: 0.7

vendor:fujimodel:electric fuji electric tellus lite v-simulatorscope:ltversion:v4.0.19.0

Trust: 0.6

sources: ZDI: ZDI-23-1730 // CNVD: CNVD-2025-24578 // JVNDB: JVNDB-2023-018322 // NVD: CVE-2023-5299

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-5299
value: HIGH

Trust: 1.0

ics-cert@hq.dhs.gov: CVE-2023-5299
value: HIGH

Trust: 1.0

NVD: CVE-2023-5299
value: HIGH

Trust: 0.8

ZDI: CVE-2023-5299
value: HIGH

Trust: 0.7

CNVD: CNVD-2025-24578
value: HIGH

Trust: 0.6

CNVD: CNVD-2025-24578
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2023-5299
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ics-cert@hq.dhs.gov: CVE-2023-5299
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.3
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2023-5299
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2023-5299
baseSeverity: HIGH
baseScore: 7.3
vectorString: AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.3
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-23-1730 // CNVD: CNVD-2025-24578 // JVNDB: JVNDB-2023-018322 // NVD: CVE-2023-5299 // NVD: CVE-2023-5299

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-284

Trust: 1.0

problemtype:others (CWE-Other) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-018322 // NVD: CVE-2023-5299

PATCH

title:Fuji Electric has issued an update to correct this vulnerability.url:https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02

Trust: 0.7

title:Patch for Fuji Electric Tellus Lite V-Simulator Access Control Violationurl:https://www.cnvd.org.cn/patchInfo/show/744651

Trust: 0.6

sources: ZDI: ZDI-23-1730 // CNVD: CNVD-2025-24578

EXTERNAL IDS

db:NVDid:CVE-2023-5299

Trust: 4.0

db:ICS CERTid:ICSA-23-325-02

Trust: 2.5

db:JVNid:JVNVU98886797

Trust: 0.8

db:JVNDBid:JVNDB-2023-018322

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-21224

Trust: 0.7

db:ZDIid:ZDI-23-1730

Trust: 0.7

db:CNVDid:CNVD-2025-24578

Trust: 0.6

db:VULMONid:CVE-2023-5299

Trust: 0.1

sources: ZDI: ZDI-23-1730 // CNVD: CNVD-2025-24578 // VULMON: CVE-2023-5299 // JVNDB: JVNDB-2023-018322 // NVD: CVE-2023-5299

REFERENCES

url:https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02

Trust: 3.3

url:https://felib.fujielectric.co.jp/en/m10009/m20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a

Trust: 1.9

url:https://jvn.jp/vu/jvnvu98886797/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-5299

Trust: 0.8

url:https://nvd.nist.gov

Trust: 0.1

sources: ZDI: ZDI-23-1730 // CNVD: CNVD-2025-24578 // VULMON: CVE-2023-5299 // JVNDB: JVNDB-2023-018322 // NVD: CVE-2023-5299

CREDITS

Fritz Sands

Trust: 0.7

sources: ZDI: ZDI-23-1730

SOURCES

db:ZDIid:ZDI-23-1730
db:CNVDid:CNVD-2025-24578
db:VULMONid:CVE-2023-5299
db:JVNDBid:JVNDB-2023-018322
db:NVDid:CVE-2023-5299

LAST UPDATE DATE

2025-12-19T22:45:54.874000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-23-1730date:2023-11-27T00:00:00
db:CNVDid:CNVD-2025-24578date:2025-11-28T00:00:00
db:VULMONid:CVE-2023-5299date:2023-11-22T00:00:00
db:JVNDBid:JVNDB-2023-018322date:2024-01-11T02:33:00
db:NVDid:CVE-2023-5299date:2024-09-04T19:35:10.513

SOURCES RELEASE DATE

db:ZDIid:ZDI-23-1730date:2023-11-27T00:00:00
db:CNVDid:CNVD-2025-24578date:2025-10-22T00:00:00
db:VULMONid:CVE-2023-5299date:2023-11-22T00:00:00
db:JVNDBid:JVNDB-2023-018322date:2024-01-11T00:00:00
db:NVDid:CVE-2023-5299date:2023-11-22T01:15:08.187