ZDI-26-366: Fuji Electric Tellus pcid64 Driver File APIs Exposed Dangerous Method Arbitrary File Deletion Vulnerability
This vulnerability allows local attackers to delete arbitrary files on affected installations of Fuji Electric Tellus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-8108.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
On systems running Fuji Electric Tellus, prevent untrusted or low-privileged code execution (the required precondition for exploitation) by enforcing application whitelisting/application control, restricting local user privileges, and limiting installation/execution of untrusted binaries and scripts to trusted administrators only.
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Affected Fuji Electric TELLUS installations are exposed when an attacker can execute low-privileged code locally on the system. It is not described as remotely exploitable from the provided information.
What access does an attacker need to exploit it?
The attacker must first obtain the ability to run low-privileged code on the target system. Successful exploitation allows arbitrary file deletion.
How severe is the issue?
ZDI assigned this issue a CVSS score of 7.8, and it is tracked as CVE-2026-8108.