CVE-2025-66605 Yokogawa CVE debrief

Who should care

Operators and administrators of Yokogawa FAST/TOOLS, especially teams managing web forms that may collect sensitive user input, should review the advisory and apply the vendor remediation. Security teams responsible for industrial control system patching and browser/data-handling policy should also care.

Technical summary

The source corpus describes a web application input-handling issue rather than code execution or service disruption. With autocomplete enabled on form fields, data entered by a user may be retained by the browser. The advisory rates the issue CVSS 3.1 3.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N), indicating remote reachability, required user interaction, and limited confidentiality impact only. The vendor mitigation is to update to revision R10.04, apply patch software CS_e12787, and then apply R10.04 SP3.

Defensive priority

Low overall, but worth scheduling with normal patching because the exposure affects user-entered data and a vendor fix is available. Prioritize systems where web forms may receive sensitive information.

Recommended defensive actions

• Update Yokogawa FAST/TOOLS to revision R10.04.
• Apply patch software CS_e12787.
• After the patch is applied, apply R10.04 SP3.
• Review web forms that collect sensitive data and disable autocomplete where appropriate.
• Align deployment hardening with CISA ICS recommended practices, including patching, zoning, hardening, whitelisting, backups, and firewalling.
• If you need vendor guidance, use the Yokogawa contact path provided in the advisory.

Evidence notes

The advisory text in the supplied CSAF source states: "Since there are input fields on this web page with the autocomplete attribute enabled, the input content could be saved in the browser the user is using." The source metadata lists no exploitation campaign, no KEV entry, and no ransomware association. The published and modified dates are both 2026-02-10, matching the CISA CSAF publication date for ICSA-26-041-01. The remediation section explicitly recommends R10.04, patch CS_e12787, and then R10.04 SP3.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.