ZDI-CAN-27673: ZDI-26-366: Fuji Electric Tellus pcid64 Driver File APIs Exposed Dangerous Method Arbitrary File Deletion Vulnerability
This vulnerability allows local attackers to delete arbitrary files on affected installations of Fuji Electric Tellus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-8108.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
On systems running Fuji Electric Tellus, mitigate exploitation by preventing untrusted low-privileged code execution: enforce application allowlisting for executable files (for example AppLocker or equivalent on Windows), remove/deny execute permissions on user-writable directories (e.g., %TEMP% and other non-admin writeable paths), and restrict local user privileges so non-privileged accounts cannot install or run arbitrary binaries or scripts. Apply the principle of least privilege to user accounts and limit the ability to run/schedule new processes by non-admin users.