What is the CVSS score of CVE-2025-66589?

CVE-2025-66589 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2025-66589?

Within 24 hours, confirm which workstations run DAQFactory 20.7 (Build 2555), restrict project-file sharing to trusted internal sources, and instruct operators and engineers not to open project files received via email, removable media, or external parties; verify that endpoint detection is logging process crashes and memory-access anomalies on those hosts. Within 7 days, inventory all DAQFactory installations and versions, isolate OT engineering workstations from general corporate network and internet access, enforce least privilege so only authorized personnel can open or edit project files, and apply application allowlisting and controlled-folder or UNC path restrictions for .daq project files. Within 30 days, monitor AzeoTech's advisory channel for a fixed build, test and deploy it as soon as it is released, and in the interim implement file-format validation or sandbox inspection of incoming project files and review backup/restore procedures for DAQFactory configurations so operations can be restored quickly after a crash.

AzeoTech DAQFactory CVE-2025-66589

HIGH

Out-of-bounds Read (CWE-125)

2025-12-11 ics-cert@hq.dhs.gov

Buffer Overflow Information Disclosure Daqfactory Azeotech

8.4

CVSS 4.0 · Vendor: hq

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious DAQFactory file
Delivery

Deliver to operator via email/USB
Exploit

Operator opens file in DAQFactory
Execution

Trigger out-of-bounds read in parser
Impact

Leak memory or crash process

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires local, file-based delivery: an attacker must get a DAQFactory 20.7 (Build 2555) user to open a specially crafted file or project (CVSS AV:L, UI:A/user interaction Active). It is not remotely or unauthenticated-network exploitable despite the HIGH score - the AV:L plus mandatory user interaction is the primary limiting factor, confining realistic risk to social-engineering or supply-of-file scenarios against OT operators. Impact is limited to information disclosure of process memory or a denial-of-service crash of the DAQFactory application; no code-integrity impact is described.
Impact	The vendor CVSS 4.0 vector (8.4, HIGH) is driven by AV:L with PR:N but UI:A (Active user interaction required) and full VC:H/VI:H/VA:H impact. That impact triad is inflated for a CWE-125 out-of-bounds READ: the description itself scopes the effect to 'disclose information or cause a system crash' - i.e., confidentiality and availability, with no integrity/code-modification primitive described, so VI:H/I:H is not supported by the stated technical impact. This is a local, file-based, client-side flaw (attacker must get a DAQFactory operator to open a crafted file/project), not a remotely triggerable network bug - the 8.4 is a HIGH number attached to a genuinely lower-real-risk, user-interaction-gated issue. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no signal of active or automatable exploitation. SSVC framework inputs (exploitation, automatable, technical impact) were not supplied. Net: treat as a moderate, targeted-risk patch item for ICS/OT operators of DAQFactory, not an emergency network-facing exposure.
Exploit ScenarioDerived	An attacker crafts a malicious DAQFactory project or data file and delivers it to an operator (email, shared drive, USB in an OT environment). When the operator opens the file in DAQFactory 20.7 (Build 2555), the parser reads past the end of an allocated buffer, leaking adjacent memory contents to the attacker or crashing the HMI/data-acquisition process. No public exploit code is identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 30, 2026

Out-of-bounds read in AzeoTech DAQFactory 20.7 (Build 2555) allows local attackers to disclose sensitive process memory or cause a denial-of-service crash by convincing a user to open a specially crafted project file. The vulnerability requires user interaction and is not remotely exploitable, but carries a high CVSS score due to potential confidentiality and availability impact. No public exploit has been identified at time of analysis.

RemediationAI

No vendor-released patch identified at time of analysis. Apply the mitigations recommended in CISA advisory ICSA-25-345-03. Until a patch is available, avoid opening DAQFactory project files from untrusted sources or received via email or web downloads. Implement application allowlisting to prevent execution of unauthorized files. Run DAQFactory with least privileges to limit the impact of memory disclosure or a crash. Monitor for unexpected application crashes as potential indicators of exploitation. Note that user training alone is not foolproof, and restricting file access may impact legitimate workflows.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is a classic out-of-bounds read (CWE-125) in AzeoTech DAQFactory, a SCADA/HMI software used for industrial data acquisition and control. When parsing a maliciously crafted project file, the application reads beyond the bounds of an allocated buffer, potentially exposing memory contents or causing a crash. The affected component is identified by CPE cpe:2.3:a:azeotech:daqfactory:*:*:*:*:*:*:*:*, which suggests all versions may be impacted, though the advisory specifies release 20.7 (Build 2555). The root cause is insufficient bounds checking on input data.

Know when Daqfactory gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (hq) PRIMARY 8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today AI 7.1 HIGH

AV:L + UI:R because a user must open a crafted local file; I:N because an out-of-bounds read yields info disclosure (C:H) and crash (A:H), not integrity impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

Active

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

In AzeoTech DAQFactory release 20.7 (Build 2555), an Out-of-bounds Read vulnerability can be exploited by an attacker to cause the program to read data past the end of an allocated buffer. This could allow an attacker to disclose information or cause a system crash.

Executive ViewAI

Why It Matters

A high-severity flaw in AzeoTech DAQFactory 20.7 (Build 2555) exposes engineering and operator workstations to memory disclosure or application crashes when a user opens a maliciously crafted project file. Because DAQFactory is typically deployed on OT/industrial systems to build HMI and data-acquisition applications, a successful attack could expose sensitive process data or interrupt visibility into controlled operations. No public exploit has been identified at time of analysis, and no vendor-released patch is currently available, so risk must be managed through interim controls and user behavior until a fix ships.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis; interim mitigations include treating project files as untrusted input (blocking external email attachments and removable-media transfer of .daq files), isolating DAQFactory hosts from untrusted networks, enforcing least privilege on who may open or edit project files, application allowlisting, and maintaining verified configuration backups to recover from denial-of-service crashes.

Threat Intelligence Overview

EPSS Score

0.4%

Top 73% exploitable

Prevalence

Low

niche HMI/SCADA data-acquisition software, industrial/OT-specific footprint

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +42

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.