EUVD-2026-37930
GHSA-m6fh-8jwg-xrjx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconCraft malicious .ctl file
-
DeliveryDeliver via email or integrator share
-
ExploitEngineer opens file in DAQFactory
-
InstallParser hits type-confusion path
-
C2Hijack control flow via mistyped pointer
-
ExecuteExecute arbitrary code as user
-
ImpactPivot into OT network
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to deliver a crafted .ctl project file to a host running AzeoTech DAQFactory 21.1 or earlier AND for a local user to actively open that file in DAQFactory (UI:A / UI:R) - the parser is not reachable over the network. No authentication or elevated privileges are needed once the file is opened (PR:N), and no non-default DAQFactory configuration is required; any default installation of an affected version is vulnerable. Limiting factors: the local attack vector means there is no remote, unauthenticated network exploitation path, and successful code execution runs at the privilege of the user who opened the file, so least-privilege accounts contain (but do not prevent) impact. |
| Impact | The CVSS 4.0 score of 8.4 reflects a high-impact but locally-vectored issue: AV:L plus UI:A means an attacker cannot reach the parser remotely without first delivering the .ctl file and convincing a user to open it in DAQFactory, while PR:N and AC:L mean that once the file is opened no privileges or special timing are required. VC:H/VI:H/VA:H captures full code execution in the user's context. There is no CISA KEV listing for this CVE and no public proof-of-concept identified at time of analysis, and no EPSS value was supplied, so probabilistic exploitation likelihood cannot be quantified - however, the OT context elevates real-world risk because DAQFactory project files are commonly emailed, copied from USB media, or pulled from integrator portals, all realistic delivery channels. The local vector should not be read as low priority for ICS asset owners; it is high priority for engineering workstations that regularly load third-party .ctl files. |
| Exploit ScenarioDerived | An attacker crafts a .ctl file whose serialized object layout triggers the type-confusion path in DAQFactory's project loader, then delivers it to a control-systems engineer as a 'updated screen file' via spear-phishing, a poisoned integrator share, or USB. When the engineer opens the file in DAQFactory 21.1 or earlier on their engineering workstation, the parser dereferences attacker-controlled bytes as a vtable or function pointer, executing arbitrary shellcode in the user's context and providing a foothold inside the OT network. No public exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 18, 2026
Code execution in AzeoTech DAQFactory versions 21.1 and prior is achievable when a user opens a maliciously crafted .ctl project file, triggering a CWE-843 type confusion that corrupts memory. The flaw was reported through CISA ICS-CERT, which is significant because DAQFactory is HMI/SCADA software where engineering project files are routinely shared between integrators and operators. There is no public exploit identified at time of analysis, but the file-borne delivery pattern is well-suited to phishing or supply-chain handoffs targeting OT engineers.
RemediationAI
Upgrade to the AzeoTech-released fixed build identified in CISA advisory ICSA-26-169-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-02); a specific patched version number was not included in the input data, so confirm the exact target version directly from AzeoTech or the advisory before deploying. Until patched, restrict which .ctl files DAQFactory loads by allow-listing project directories under operator control, refuse to open .ctl files received by email or from external integrators without out-of-band verification of authenticity, and run DAQFactory under a least-privilege Windows account so successful exploitation does not yield local administrator (this limits blast radius but does not prevent process-level code execution). Network-segmenting engineering workstations away from corporate email and removing direct internet access from OT hosts reduces realistic delivery paths, at the cost of operational friction for engineers who currently pull projects from vendor portals.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DAQFactory is an HMI/data-acquisition application from AzeoTech used in industrial control environments to build operator screens, log process data, and interface with PLCs/serial devices. The vulnerable artifact is the .ctl file format, which DAQFactory parses to load project/control definitions; the parser exhibits CWE-843 (Access of Resource Using Incompatible Type - 'Type Confusion'), where an object allocated as one type is later interpreted as another, producing a mismatch between the in-memory layout and the code reading it. Such confusions typically allow attacker-controlled fields to be treated as pointers or function references, providing a path from file parsing to arbitrary code execution in the DAQFactory process. The affected CPE is cpe:2.3:a:azeotech:daqfactory:*:*:*:*:*:*:*:* with the upper bound being 21.1.
Know when Daqfactory gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Parsing a local .ctl file requires the user to open it (UI:R) but no privileges (PR:N); type confusion yields full process-level code execution, so C/I/A all High; scope unchanged.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
DescriptionCVE.org
In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.
Zero Day Initiative Advisories
Executive ViewAI
DAQFactory, a critical HMI/SCADA platform used by manufacturing and operations teams, contains a code execution vulnerability (CVE-2026-12390, CVSS 8.4) triggered by opening maliciously crafted project files. The attack vector aligns with normal engineering workflows-project file sharing between integrators and plant operators-making it particularly suitable for supply-chain or phishing-based delivery. No vendor patch is available, leaving affected organizations without immediate remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict .ctl file imports to air-gapped, non-networked engineering stations only; (2) implement endpoint detection and response (EDR) on systems that must process external project files; (3) enforce file integrity monitoring on DAQFactory runtime directories; (4) establish mandatory out-of-band verification protocol (phone/secure messaging) before accepting project files from external suppliers or integrators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Daqfactory
View allArbitrary code execution in AzeoTech DAQFactory (versions 21.1 and prior) arises from a use-after-free flaw triggered wh
Out-of-bounds read in AzeoTech DAQFactory 20.7 (Build 2555) allows local attackers to disclose sensitive process memory
Out-of-bounds write in AzeoTech DAQFactory release 20.7 (Build 2555) enables arbitrary code execution or denial of servi
Arbitrary code execution in AzeoTech DAQFactory release 20.7 (Build 2555) is possible when a local user opens or interac
Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized ag
The affected application uses specific functions that could be abused through a crafted project file, which could lead t
Local code execution in AzeoTech DAQFactory release 20.7 (Build 2555) is possible when a user opens a maliciously crafte
Type confusion in AzeoTech DAQFactory 20.7 (Build 2555) enables arbitrary code execution when a user opens a maliciously
An Incorrect Default Permissions issue was discovered in AzeoTech DAQFactory versions prior to 17.1. Rated high severity
An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and tr
The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP. Rated medium severity
An Uncontrolled Search Path Element issue was discovered in AzeoTech DAQFactory versions prior to 17.1. Rated medium sev
Exploit-DB