PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-66588 AzeoTech CVE debrief

AzeoTech DAQFactory release 20.7 (Build 2555) contains an Access of Uninitialized Pointer vulnerability that can lead to arbitrary code execution. This vulnerability was disclosed by CISA on December 11, 2025, and subsequently modified on January 12, 2026. The CVSS 3.1 score of 7.8 (HIGH) reflects local attack vector with low attack complexity, no privileges required, but user interaction required. The vulnerability affects industrial control system environments where DAQFactory is deployed for data acquisition and process control. AzeoTech has released DAQFactory version 21.1 as a vendor fix. CISA recommends defense-in-depth measures including restricting document sources, file permission controls, safe mode operation, and document password protection.

Vendor
AzeoTech
Product
DAQFactory
CVSS
HIGH 8.4
CISA KEV
Not listed in stored evidence
Original CVE published
2025-12-11
Original CVE updated
2026-10-07
Advisory published
2025-12-11
Advisory updated
2026-10-07

Who should care

Organizations running AzeoTech DAQFactory 20.7 (Build 2555) in industrial control, manufacturing, laboratory automation, or data acquisition environments. Security teams responsible for OT/ICS asset management, patch management programs covering operational technology, and personnel handling .ctl document workflows in DAQFactory deployments.

Technical summary

The vulnerability exists in AzeoTech DAQFactory release 20.7 (Build 2555) due to access of an uninitialized pointer. An attacker can exploit this condition to achieve arbitrary code execution. The attack requires local access and user interaction (such as opening a malicious document), but does not require elevated privileges. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates high impacts to confidentiality, integrity, and availability. The vulnerability is particularly relevant in operational technology environments where DAQFactory is used for supervisory control and data acquisition. The vendor has addressed the issue in Release 21.1.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade to DAQFactory Release 21.1 to address the uninitialized pointer vulnerability
  • Restrict .ctl file loading to documents from trusted sources only
  • Store .ctl files in directories with admin-only write permissions
  • Enable Safe Mode when loading documents that have been outside organizational control
  • Apply document editing passwords to protect .ctl files from unauthorized modification
  • Implement network segmentation for DAQFactory systems per CISA ICS recommended practices
  • Monitor for anomalous process execution or document loading behaviors on affected systems

Evidence notes

Vulnerability details sourced from CISA CSAF advisory ICSA-25-345-03. Advisory underwent revision on 2025-12-30 (Update A) removing duplicative CVEs, and final revision on 2026-01-12 updating acknowledgments. CVSS 3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-66588 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-66588

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-66588 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-66588

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-345-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.