CVE-2025-66585: 
AzeoTech DAQFactory vulnerability analysis and mitigation

CVE-2025-66585 is a Use After Free (UAF) vulnerability in AzeoTech DAQFactory release 20.7 (Build 2555) that allows an attacker to cause memory corruption while parsing specially crafted .ctl files, potentially enabling arbitrary code execution in the context of the current process. It affects all DAQFactory versions up to and including 20.7 (Build 2555); the fixed version is Release 21.1. The vulnerability was initially published on December 11, 2025, with an updated advisory (Update A) released December 30, 2025. It carries a CVSS v3.1 base score of 7.8 (High) (CISA Advisory, ZDI Advisory).

The vulnerability is classified as CWE-416 (Use After Free): DAQFactory's .ctl file parser accesses memory that has already been freed, leading to memory corruption. An attacker must supply a specially crafted .ctl file that triggers the UAF condition during parsing; the application then operates on the corrupted memory, which can be leveraged to redirect execution flow. Exploitation requires local access and user interaction — specifically, a user must open the malicious file — and is not remotely exploitable. The vulnerability was reported to CISA by Michael Heinzl and Andrea Micalizzi (@rgod777) of Trend Micro Zero Day Initiative, with a ZDI advisory (ZDI-25-1128) published December 17, 2025 (CISA Advisory, ZDI Advisory).

Successful exploitation allows an attacker to execute arbitrary code in the context of the DAQFactory process, with the same privileges as the running user. This can result in full confidentiality, integrity, and availability compromise of the affected system — including access to sensitive industrial control data, modification of process configurations, and potential disruption of manufacturing operations. Given DAQFactory's role in critical manufacturing environments, exploitation could have downstream effects on industrial processes, though lateral movement is constrained by the local-only attack vector (CISA Advisory).

No known public exploitation specifically targeting CVE-2025-66585 has been reported to CISA at this time, and the vulnerability is not remotely exploitable (CISA Advisory). A ZDI advisory (ZDI-25-1128) was published on December 17, 2025, providing technical details that could assist in developing exploits (ZDI Advisory). The EPSS score is approximately 0.016% (0.000160), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft a malicious .ctl file: Create a specially crafted AzeoTech DAQFactory .ctl project file that triggers the Use After Free condition during parsing — specifically by manipulating memory allocation/deallocation sequences within the file's structure to cause a freed memory region to be referenced.
2. Deliver the file to the target: Use social engineering (e.g., phishing email, shared network drive, or supply chain compromise) to deliver the malicious .ctl file to a user operating a vulnerable DAQFactory instance (version ≤ 20.7 Build 2555).
3. Induce user interaction: Convince the target user to open the malicious .ctl file within DAQFactory, triggering the vulnerable file parsing code path.
4. Trigger memory corruption: The parser accesses freed memory, causing memory corruption that can be leveraged to overwrite control flow data (e.g., function pointers or vtable entries).
5. Achieve code execution: With controlled memory corruption, execute arbitrary code in the context of the DAQFactory process, enabling actions such as deploying a backdoor, exfiltrating data, or manipulating industrial control configurations (CISA Advisory, ZDI Advisory).

• File System: Presence of unexpected or externally sourced .ctl files in DAQFactory project directories; .ctl files stored in locations writable by non-administrative users.
• Process: Unusual child processes spawned by the DAQFactory process (e.g., cmd.exe, powershell.exe, scripting interpreters); DAQFactory process crashing or exhibiting abnormal behavior upon opening a .ctl file.
• Logs: Application crash logs or Windows Event Log entries (Event ID 1000/1001) referencing DAQFactory at the time of .ctl file parsing; unexpected access violations or heap corruption errors in DAQFactory logs.
• Network: Unexpected outbound network connections from the DAQFactory host process following the opening of a .ctl file, particularly to external or unknown IP addresses (CISA Advisory).

AzeoTech has released DAQFactory Release 21.1, which addresses CVE-2025-66585 and all related vulnerabilities in the advisory. Users unable to upgrade immediately should apply the following mitigations: avoid opening .ctl files from unknown or untrusted sources; restrict .ctl file storage directories to be writable only by administrative users; enable DAQFactory's "Safe Mode" when loading files that have been outside of organizational control; and apply a document editing password to project files. Additionally, CISA recommends isolating ICS networks behind firewalls, minimizing internet exposure, and using VPNs for any required remote access (CISA Advisory).