AzeoTech DAQFactory CVE-2025-66585

Exploitation requires a victim to open a specially crafted .ctl project/control file in AzeoTech DAQFactory release 20.7 Build 2555 on Windows; the attacker must deliver this file via phishing, removable media, a compromised project repository, or another local delivery channel (CVSS AV:L). Limiting factors per the CVSS:4.0 vector: passive user interaction is required (UI:P - the engineer must open the file), attack complexity is High (AC:H, consistent with non-trivial heap grooming for reliable UAF exploitation), and the bug runs in the context of the DAQFactory user process, so privileges gained equal those of the workstation user. No authentication to the application is required (PR:N), but no network-reachable attack surface is exposed - purely a client-side file-parsing vulnerability.

The CVSS:4.0 vector AV:L/AC:H/AT:N/PR:N/UI:P scores 7.3 (High) but the real-world risk profile is more nuanced: exploitation requires LOCAL delivery of a malicious .ctl file, HIGH attack complexity, and PASSIVE user interaction (an engineer must open the file). EPSS data was not provided in the input, the CVE is not on CISA KEV, and no POC is referenced, so there is no public exploit identified at time of analysis. However, the C/I/A=High impact and the ICS context (engineering workstations frequently sit adjacent to OT networks) mean a successful social-engineering or supply-chain delivery of a poisoned .ctl project file could give an attacker a foothold on a SCADA development host. The CVSS Local vector is consistent with the description (file-parsing bug requiring user to open the file), so signals are aligned rather than conflicting; the limiting factors are the AC:H complexity typical of UAF heap-grooming and the UI:P requirement.

An attacker phishes a control-systems engineer or drops a malicious .ctl project file on a USB stick or shared engineering fileshare; the engineer opens the file in DAQFactory 20.7 Build 2555, the parser triggers the use-after-free, and a pre-staged heap layout in the crafted file lets the attacker hijack execution to run shellcode as the engineer's user. The foothold on the engineering workstation can then be pivoted toward connected PLCs, HMIs, or historians on the OT network. No public exploit identified at time of analysis, so any near-term attack would require independent exploit development against a non-trivial UAF (CVSS AC:H).