Which versions of AzeoTech DAQFactory are affected by CVE-2026-12390?

DAQFactory, a critical HMI/SCADA platform used by manufacturing and operations teams, contains a code execution vulnerability (CVE-2026-12390, CVSS 8.4) triggered by opening maliciously crafted…

How to fix or mitigate CVE-2026-12390?

Within 24 hours: Identify all systems running DAQFactory versions 21.1 and earlier; document version inventory and network connectivity. Within 7 days: Restrict .ctl file execution to trusted, air-gapped engineering workstations; implement email content filtering for .ctl attachments from external senders; require out-of-band verification before accepting project files. Within 30 days: Monitor AzeoTech security advisories for patch availability; evaluate business continuity impact of disabling external project file import; assess feasibility of upgrading to versions later than 21.1.

AzeoTech DAQFactory CVE-2026-12390

Q: What is the CVSS score of CVE-2026-12390?

CVE-2026-12390 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-37930 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-18 icscert

GHSA-m6fh-8jwg-xrjx

RCE Memory Corruption Daqfactory Azeotech

8.4

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Parsing a local .ctl file requires the user to open it (UI:R) but no privileges (PR:N); type confusion yields full process-level code execution, so C/I/A all High; scope unchanged.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 19:00 vuln.today

DescriptionCVE.org

In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.

AnalysisAI

Code execution in AzeoTech DAQFactory versions 21.1 and prior is achievable when a user opens a maliciously crafted .ctl project file, triggering a CWE-843 type confusion that corrupts memory. The flaw was reported through CISA ICS-CERT, which is significant because DAQFactory is HMI/SCADA software where engineering project files are routinely shared between integrators and operators. There is no public exploit identified at time of analysis, but the file-borne delivery pattern is well-suited to phishing or supply-chain handoffs targeting OT engineers.

Technical ContextAI

DAQFactory is an HMI/data-acquisition application from AzeoTech used in industrial control environments to build operator screens, log process data, and interface with PLCs/serial devices. The vulnerable artifact is the .ctl file format, which DAQFactory parses to load project/control definitions; the parser exhibits CWE-843 (Access of Resource Using Incompatible Type - 'Type Confusion'), where an object allocated as one type is later interpreted as another, producing a mismatch between the in-memory layout and the code reading it. Such confusions typically allow attacker-controlled fields to be treated as pointers or function references, providing a path from file parsing to arbitrary code execution in the DAQFactory process. The affected CPE is cpe:2.3:a:azeotech:daqfactory:*:*:*:*:*:*:*:* with the upper bound being 21.1.

RemediationAI

Upgrade to the AzeoTech-released fixed build identified in CISA advisory ICSA-26-169-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-02); a specific patched version number was not included in the input data, so confirm the exact target version directly from AzeoTech or the advisory before deploying. Until patched, restrict which .ctl files DAQFactory loads by allow-listing project directories under operator control, refuse to open .ctl files received by email or from external integrators without out-of-band verification of authenticity, and run DAQFactory under a least-privilege Windows account so successful exploitation does not yield local administrator (this limits blast radius but does not prevent process-level code execution). Network-segmenting engineering workstations away from corporate email and removing direct internet access from OT hosts reduces realistic delivery paths, at the cost of operational friction for engineers who currently pull projects from vendor portals.