AzeoTech DAQFactory CVE-2025-66590

Exploitation requires local delivery of a malicious DAQFactory project or input file to a host running AzeoTech DAQFactory release 20.7 (Build 2555), and the legitimate user must actively open or interact with that file in DAQFactory (CVSS AV:L plus UI:A). No authentication to DAQFactory itself is required (PR:N), but the attacker needs a delivery channel onto the engineering workstation - typically phishing, removable media, or a compromised project repository - and the operator must execute the trigger action; there is no remote network-listening service exposure indicated, which limits worm-style or internet-facing mass exploitation.

The CVSS 4.0 score of 8.4 reflects AV:L (local attack vector), AC:L, PR:N (no privileges) but UI:A (active user interaction required), with high confidentiality, integrity, and availability impact on the vulnerable system and no propagation to subsequent systems. This is therefore not a remote unauthenticated RCE despite the RCE/Buffer Overflow tags - an operator must actively open or interact with a malicious project/configuration file, which materially lowers real-world exploitability. No EPSS score, KEV listing, or public POC was provided, and the only references are the CISA ICS advisory ICSA-25-345-03 and its CSAF JSON; combined with the local+UI vector, this points to targeted operator-phishing or supply-chain delivery rather than mass exploitation. The risk remains meaningful for ICS asset owners because compromise of a DAQFactory workstation can pivot into OT networks, so it should be prioritized for patching even though raw exploitation probability appears low.

An attacker delivers a crafted DAQFactory project or configuration file to a plant engineer via spear-phishing, a USB drop, or a compromised integrator share; when the engineer opens the file in DAQFactory 20.7 (Build 2555), parsing logic writes past an allocated buffer and the attacker gains code execution as the operator on the HMI workstation. From that foothold the attacker can crash the application to disrupt monitoring or pivot deeper into the OT network. No public exploit identified at time of analysis.