Read the docs
TI-2021-16005 Aliases CVE-2021-38401GHSA-vh53-pj8h-4mgx

Fuji Electric Tellus Lite V-Simulator untrusted pointer dereference

Priority LOW 36CWE-822Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-822 and the CVSS impact.

Summary

Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an untrusted pointer dereference, which may allow an attacker to execute arbitrary code and cause the application to crash.

Why it matters now

EPSS 0.00975 62nd percentileScored 2026-11-07
Fix Fixed V-Server Lite (Fuji Electric): 4.0.12.0Tellus Lite V-Simulator (Fuji Electric): 4.0.12.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Fuji ElectricV-Server Litebefore 4.0.12.04.0.12.0Patch availableCNA
Fuji ElectricTellus Lite V-Simulatorbefore 4.0.12.04.0.12.0Patch availableCNA
  • V-Server Lite VendorFuji Electric Affected before 4.0.12.0 Fixed in 4.0.12.0 Patch available CNA
  • Tellus Lite V-Simulator VendorFuji Electric Affected before 4.0.12.0 Fixed in 4.0.12.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:fujielectric:v-server:*:*:*:*:lite:*:*:*before 4.0.12.0VulnerableFuji Electric
cpe:2.3:a:fujielectric:v-simulator:*:*:*:*:lite:*:*:*before 4.0.12.0VulnerableFuji Electric
  • cpe:2.3:a:fujielectric:v-server:*:*:*:*:lite:*:*:* Versions before 4.0.12.0 Vulnerable ·Fuji Electric
  • cpe:2.3:a:fujielectric:v-simulator:*:*:*:*:lite:*:*:* Versions before 4.0.12.0 Vulnerable ·Fuji Electric

Remediation

  • Fix · CNA V-Server Lite (Fuji Electric) Fixed in 4.0.12.0
  • Fix · CNA Tellus Lite V-Simulator (Fuji Electric) Fixed in 4.0.12.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Fuji Electric Tellus Lite V-Simulator, V-Server Lite 4.0.12.0

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2021-16022 Fuji Electric Tellus Lite V-Simulator out of bounds writePriority LOW 36
    • TI-2021-16018 Fuji Electric Tellus Lite V-Simulator heap based buffer overflowPriority LOW 36
    • TI-2021-16017 Fuji Electric Tellus Lite V-Simulator stack based buffer overflowPriority LOW 36
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-38401
  2. 2026-10-03 Alias added: GHSA-vh53-pj8h-4mgx

References

Patch 1

  • TI-2019-13257 Heap-based buffer overflow in Fuji Electric V-Server 4.0.6 and prior CVSS 3.1CRITICAL 9.8
  • TI-2019-02953 Insufficiently protected credentials in Fuji Electric V-Server CVSS 3.0CRITICAL 9.8
  • TI-2021-05534 Heap-based buffer overflow in Tellus Lite V-Simulator and V-Server Lite CVSS 3.1HIGH 7.8
  • TI-2021-05532 An uninitialized pointer issue has been identified in the way the application processes… CVSS 3.1HIGH 7.8
  • TI-2021-05530 Stack-based buffer overflow in Tellus Lite V-Simulator and V-Server Lite CVSS 3.1HIGH 7.8
  • TI-2018-07524 Buffer overflow in Fuji Electric V-Server Lite CVSS 3.0HIGH 7.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences