PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-66585 AzeoTech CVE debrief

A Use After Free vulnerability in AzeoTech DAQFactory release 20.7 (Build 2555) allows memory corruption through parsing of malicious .ctl files, potentially enabling arbitrary code execution in the context of the current process. The vulnerability requires local access with user interaction, as an attacker must convince a user to open a specially crafted file. CISA published this advisory on December 11, 2025, with an update (Update A) on December 30, 2025, that revised researcher acknowledgments and removed two related CVEs after determining they were duplicative. A further revision on January 12, 2026, updated acknowledgments and revision history documentation. The vendor has released DAQFactory version 21.1 to address this issue.

Vendor
AzeoTech
Product
DAQFactory
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2025-12-11
Original CVE updated
2026-10-07
Advisory published
2025-12-11
Advisory updated
2026-10-07

Who should care

Organizations using AzeoTech DAQFactory for industrial automation and data acquisition, particularly those in manufacturing, energy, water/wastewater, and other critical infrastructure sectors where DAQFactory is deployed for SCADA or HMI functionality.

Technical summary

The vulnerability exists in the .ctl file parsing component of DAQFactory 20.7 (Build 2555). A Use After Free condition occurs when processing malformed file structures, leading to memory corruption. Successful exploitation could result in arbitrary code execution within the process context. The attack requires local access and user interaction to open a malicious file. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates high impacts to confidentiality, integrity, and availability once exploited.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade to DAQFactory Release 21.1 to remediate this vulnerability.
  • Avoid opening .ctl files from unknown or untrusted sources.
  • Store .ctl files in directories with admin-only write permissions.
  • Use DAQFactory's Safe Mode when loading documents that have been outside organizational control.
  • Apply document editing passwords to protect .ctl files from unauthorized modification.
  • Implement application whitelisting and endpoint protection on systems running DAQFactory.
  • Monitor for suspicious file operations involving .ctl files in user-accessible directories.

Evidence notes

Vulnerability confirmed in DAQFactory release 20.7 (Build 2555). CVSS 3.1 score of 7.8 reflects local attack vector with low attack complexity, no privileges required, but user interaction needed. Advisory revision history documents removal of CVE-2025-66584 and CVE-2025-66587 as duplicative entries.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-66585 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-66585

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-66585 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-66585

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-345-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.