ID

VAR-202512-0019

CVE

CVE-2025-66589

TITLE

AzeoTech DAQFactory CTL File Parsing Memory Corruption Remote Code Execution Vulnerability

DESCRIPTION

In AzeoTech DAQFactory release 20.7 (Build 2555), an Out-of-bounds Read vulnerability can be exploited by an attacker to cause the program to read data past the end of an allocated buffer. This could allow an attacker to disclose information or cause a system crash. This vulnerability allows remote attackers to execute arbitrary code on affected installations of AzeoTech DAQFactory. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of CTL files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. AzeoTech DAQFactory is a data acquisition and monitoring software developed by AzeoTech, a US-based company, commonly used in industrial automation. AzeoTech DAQFactory contains an out-of-bounds read vulnerability

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Rocco Calvi (@TecR0c) with TecSecurity

SOURCES

LAST UPDATE DATE

2025-12-20T19:39:02.534000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE