CVE-2025-66590: 
AzeoTech DAQFactory vulnerability analysis and mitigation

CVE-2025-66590 is an Out-of-bounds Write vulnerability (CWE-787) in AzeoTech DAQFactory release 20.7 (Build 2555) that allows an attacker to cause the program to write data past the end of an allocated memory buffer, potentially leading to arbitrary code execution or a system crash. The vulnerability affects all DAQFactory versions up to and including 20.7 Build 2555, with version 21.1 being the first patched release. It was publicly disclosed on December 11, 2025, via CISA ICS Advisory ICSA-25-345-03, and updated on December 30, 2025 (Update A). The CVSS v3.1 base score is 7.8 (High) per the vendor/CISA advisory, while NVD initially scored it 9.8 (Critical) (CISA Advisory, Feedly).

The vulnerability is classified as CWE-787 (Out-of-bounds Write) and is triggered during the parsing of specially crafted .ctl (control) files by the DAQFactory application. When a malicious .ctl file is opened, insufficient bounds checking allows the application to write data beyond the end of an allocated memory buffer, corrupting adjacent memory. Exploitation requires local access and user interaction — specifically, a user must be tricked into opening a malicious .ctl file. Three Zero Day Initiative advisories (ZDI-25-1129, ZDI-25-1130, ZDI-25-1162) document related technical details for this vulnerability (CISA Advisory, ZDI-25-1130, ZDI-25-1162).

Successful exploitation of CVE-2025-66590 can result in arbitrary code execution in the context of the current process or a complete system crash (denial of service). Given that DAQFactory is an industrial HMI/SCADA platform used in critical manufacturing environments, a successful attack could compromise operational technology (OT) systems, lead to data theft, disrupt industrial processes, or serve as a pivot point for lateral movement within ICS networks. Confidentiality, integrity, and availability are all rated as High impact (CISA Advisory).

Multiple proof-of-concept exploits are publicly available via the Trend Micro Zero Day Initiative (ZDI-25-1129, ZDI-25-1130, ZDI-25-1162), published on December 17 and 19, 2025. The vulnerability was reported to CISA by Michael Heinzl, Rocco Calvi (@TecR0c) of TecSecurity, and Andrea Micalizzi (@rgod777), all through Trend Micro ZDI. No in-the-wild exploitation has been reported to CISA at this time, and the vulnerability is not remotely exploitable — it requires local access and user interaction (opening a malicious file). The EPSS score is approximately 0.016% (very low probability of exploitation in the near term), and it is not listed in the CISA KEV catalog (CISA Advisory, ZDI-25-1130, Feedly).

1. Craft a malicious CTL file: Using knowledge from the ZDI proof-of-concept advisories, an attacker creates a specially crafted .ctl file that contains malformed data designed to trigger an out-of-bounds write during DAQFactory's file parsing routine.
2. Deliver the malicious file: The attacker delivers the .ctl file to a target user via phishing email, a compromised file share, a USB drive, or by substituting a legitimate .ctl file in a location accessible to the target (e.g., a shared network folder).
3. Induce user interaction: The attacker social-engineers the target user into opening the malicious .ctl file with the vulnerable DAQFactory application (version ≤ 20.7 Build 2555).
4. Trigger out-of-bounds write: When DAQFactory parses the malicious file, insufficient bounds checking causes the application to write attacker-controlled data past the end of an allocated memory buffer, corrupting adjacent memory structures.
5. Achieve code execution: By carefully controlling the corrupted memory content (e.g., overwriting function pointers or return addresses), the attacker redirects execution flow to attacker-supplied shellcode or a ROP chain, achieving arbitrary code execution in the context of the DAQFactory process (CISA Advisory, ZDI-25-1130).

• File System: Presence of unexpected or externally sourced .ctl files in DAQFactory project directories; new or modified files in the DAQFactory installation directory created around the time of a file-open event.
• Process: Unusual child processes spawned by the DAQFactory process (e.g., cmd.exe, powershell.exe, wscript.exe); DAQFactory process crashing unexpectedly (application crash logs/minidumps).
• Logs: Windows Event Logs showing DAQFactory application errors or crashes (Event ID 1000/1001 in Application log) coinciding with opening of an external .ctl file; audit logs showing .ctl files accessed from untrusted or external locations.
• Network: Unexpected outbound network connections from the DAQFactory process to external IP addresses following a file-open event, which may indicate post-exploitation activity such as reverse shell or data exfiltration (CISA Advisory).

AzeoTech has released DAQFactory Release 21.1, which addresses CVE-2025-66590 and all related vulnerabilities in the advisory. Organizations should upgrade immediately. Until patching is complete, AzeoTech and CISA recommend the following mitigations: (1) Do not open .ctl files from unknown or untrusted sources; (2) Store .ctl files in folders writable only by admin-level users; (3) Use DAQFactory's "Safe Mode" when loading documents that have been outside organizational control; (4) Apply a document editing password to DAQFactory documents. Additionally, CISA recommends isolating ICS networks behind firewalls, minimizing internet exposure, and using VPNs for remote access (CISA Advisory).

CISA published ICS Advisory ICSA-25-345-03 on December 11, 2025, coordinating disclosure with AzeoTech and the Trend Micro Zero Day Initiative. The advisory was updated on December 30, 2025 (Update A) to refine researcher attribution and remove duplicate CVEs. Trend Micro ZDI published three separate advisories (ZDI-25-1129, ZDI-25-1130, ZDI-25-1162) covering this and related vulnerabilities, reflecting the significance of the findings to the ICS security research community (CISA Advisory, ZDI-25-1130).