AzeoTech DAQFactory CVE-2025-66588

Exploitation requires local delivery of a malicious DAQFactory artifact (project, configuration, or comparable input) and active user interaction by an operator with DAQFactory 20.7 (Build 2555) installed - the CVSS 4.0 vector confirms AV:L (local), AC:L (low complexity), PR:N (no prior privileges on the target needed beyond the user who opens the file), and UI:A (active interaction such as opening the file). No network-reachable service is exposed by this flaw, so remote unauthenticated exploitation is not in scope; the practical limit is the attacker's ability to get a crafted file in front of an engineer running the affected build, and the impact is scoped to the vulnerable component (SC:N/SI:N/SA:N) rather than the underlying OS.

The CVSS 4.0 base score of 8.4 is driven by high confidentiality, integrity, and availability impact on the vulnerable component, but the vector explicitly requires local access (AV:L) and active user interaction (UI:A), which materially reduces real-world exploitability compared to a network-reachable RCE. EPSS data was not provided and the vulnerability is not listed in CISA KEV, so there is no public exploit identified at time of analysis and no evidence of in-the-wild abuse; the report came through ICS-CERT coordinated disclosure rather than incident response. The realistic risk is moderate-to-high specifically for OT/engineering workstations where DAQFactory project files or configurations may be exchanged between sites, since a single trusted engineer opening a malicious project could compromise an HMI host that sits adjacent to control systems - a classic ICS lateral-movement vector even without a network-facing exploit.

An attacker emails or shares a crafted DAQFactory project or configuration file to an OT engineer; when the engineer opens it in DAQFactory 20.7 (Build 2555), the application dereferences an uninitialized pointer that the file content has steered toward attacker-controlled memory, yielding arbitrary code execution in the user's context. From the compromised engineering workstation the attacker can pivot toward PLCs, historians, and other ICS assets that trust the HMI host.