An Improper Privilege Management issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• fujielectric monitouch v-sftup to 5.4.42.0 inclusive

Other highest-scoring records for the same primary product.

• CVE-2017-9660A Heap-Based Buffer Overflow was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0.
  37Monitor
• CVE-2017-9659A Stack-Based Buffer Overflow issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0.
  37Monitor
• CVE-2024-5597Fuji Electric Monitouch V-SFT Type Confusion
  34Monitor
• CVE-2024-5271Fuji Electric Monitouch V-SFT Access of Resource Using Incompatible Type ('Type Confusion')
  34Monitor
• CVE-2024-34171Fuji Electric Monitouch V-SFT Stack-Based Buffer Overflow
  34Monitor
• CVE-2025-54526Fuji Electric Monitouch V-SFT-6 Stack-based Buffer Overflow
  33Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

To simplify setup, a service account is granted broad, cluster-wide permissions. The principle of least privilege is skipped during installation.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1kind: ClusterRole2rules:3  - apiGroups: ["*"]4    resources: ["*"]5    verbs: ["*"]

1kind: Role2metadata:3  namespace: lodos-system4rules:5  - apiGroups: ["apps"]6    resources: ["deployments"]7    verbs: ["get", "list", "update"]

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.