CVE-2025-66594 Yokogawa CVE debrief

Who should care

OT/ICS operators, plant security teams, and administrators responsible for Yokogawa FAST/TOOLS deployments should prioritize this advisory, especially where the system is reachable from internal or external networks or where error pages may be exposed to users.

Technical summary

The supplied advisory describes an information exposure condition in FAST/TOOLS error handling. The published CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, which corresponds to a score of 5.3 (Medium). Yokogawa recommends updating to revision R10.04, applying patch software CS_e12787, and then applying R10.04 SP3. The advisory also recommends broader security controls such as patching, antivirus, backup and recovery, zoning, hardening, whitelisting, and firewalls.

Defensive priority

Medium priority for exposure reduction and patch management. The issue does not indicate disruption or direct code execution in the supplied corpus, but it may support follow-on attacks by revealing details that should not be visible.

Recommended defensive actions

• Upgrade to Yokogawa FAST/TOOLS revision R10.04, apply patch software CS_e12787, and then apply R10.04 SP3.
• Review externally or internally reachable error pages and ensure detailed messages are not exposed to unauthenticated users.
• Apply compensating controls recommended by Yokogawa and CISA, including zoning, hardening, whitelisting, and firewall restrictions.
• Validate backups and recovery procedures before maintenance windows.
• Use the official Yokogawa contact path for clarification or deployment questions if needed.

Evidence notes

Based only on the supplied CISA CSAF advisory ICSA-26-041-01 for CVE-2025-66594. The advisory states: "Detailed messages are displayed on the error page. This information could be exploited by an attacker for other attacks." The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3 Medium). Remediation in the source corpus is to update to R10.04, apply patch software CS_e12787, and then apply R10.04 SP3. No KEV listing is present in the supplied data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.