What is the CVSS score of CVE-2025-66603?

CVE-2025-66603 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Fast Tools are affected by CVE-2025-66603?

A critical vulnerability in Yokogawa's FAST/TOOLS web server allows attackers to exploit the OPTIONS HTTP method to potentially bypass security controls and gain unauthorized access to industrial…

How to fix or mitigate CVE-2025-66603?

Within 24 hours: Identify and inventory all FAST/TOOLS instances in your environment; restrict network access to affected systems via firewall rules limiting to trusted administrative IPs only. Within 7 days: Deploy WAF rules to block or monitor OPTIONS method requests to FAST/TOOLS; segment affected systems from general corporate networks and untrusted zones. Within 30 days: Monitor Yokogawa security advisories for patch availability; conduct vulnerability assessment to identify alternative mitigations or system replacement options; document all compensating controls in your change management system.

Fast Tools CVE-2025-66603

CRITICAL

Improperly Implemented Security Check for Standard (CWE-358)

2026-02-09 7168b535-132a-4efe-a076-338f829b2eb9

Information Disclosure Fast Tools

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 09, 2026 - 04:15 nvd

CRITICAL 9.8

DescriptionCVE.org

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.

The web server accepts the OPTIONS method. An attacker could potentially use this information to carry out other attacks.

The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04

AnalysisAI

Yokogawa FAST/TOOLS has a second web server vulnerability involving improper cryptographic handling that weakens the security of SCADA communications.