AzeoTech DAQFactory CVE-2025-66586

Exploitation requires the target to open a specially crafted .ctl project file in AzeoTech DAQFactory release 20.7 Build 2555 on the local machine; the CVSS 4.0 vector AV:L/AC:H/PR:N/UI:P confirms local attack vector, no privileges, and active user interaction (opening the file). Limiting factors include high attack complexity (AC:H), meaning the attacker must reliably groom memory to weaponize the type confusion, the need for social engineering or physical media to deliver the .ctl file, and that impact is confined to the DAQFactory process context (S:N, no scope change) rather than the wider OS. There are no network-exposed services involved and no authentication is required of the attacker because the victim user supplies the execution context.

The CVSS 4.0 vector AV:L/AC:H/AT:N/PR:N/UI:P scores 7.3 (High) but accurately reflects a constrained threat model: exploitation requires local file delivery, user interaction to open the .ctl file, and high attack complexity, while impact on confidentiality, integrity, and availability of the vulnerable component is high with no scope change. This is a classic client-side ICS engineering-workstation risk rather than a network-exposed RCE, so it ranks below internet-facing flaws on patch urgency yet remains material because compromise of an engineering workstation often pivots into OT networks. No EPSS score and no KEV listing were provided in the input, and no public PoC is referenced - exploitability signals are therefore weak, and the realistic risk is targeted spear-phishing or supply-chain delivery of malicious project files to operators rather than mass exploitation.

An attacker crafts a malicious DAQFactory .ctl project file and delivers it to an engineer via spear-phishing, a USB drop, or a poisoned vendor/integrator share. When the engineer opens the file in DAQFactory 20.7 Build 2555, the type-confusion bug corrupts memory during parsing and executes the attacker's shellcode in the DAQFactory process, giving a foothold on the engineering workstation that can be used to pivot into the OT/control network.