AzeoTech DAQFactory CVE-2026-12921

Exploitation requires a victim to open a specially crafted .ctl (DAQFactory control/project) file in AzeoTech DAQFactory version 21.1 or earlier - the malicious file format is the exact trigger named in the advisory. The CVSS vector confirms active user interaction is mandatory (UI:A) and the vector is local (AV:L), so there is no remote, network-facing exploitation path; the attacker must get the crafted file onto the host and have an operator open it. Limiting factors that reduce real-world risk: dependence on operator action/social engineering, local file delivery, and confinement to vulnerable DAQFactory versions. No special product configuration or feature toggle is called out beyond using DAQFactory to open the file.

Signals are largely consistent and point to a real but operator-gated risk rather than a mass-exploitable internet threat. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H) shows a local attack vector with required active user interaction and no privileges, yielding high impact across all three pillars and a base score of 8.4. Because exploitation depends on a victim opening a malicious .ctl file, it cannot be automated network-wide and relies on social engineering or delivery of a tampered project file, which lowers practical likelihood relative to the raw score. No EPSS value was supplied, there is no public exploit identified at time of analysis, and the CVE is not in CISA KEV, so there is no evidence of active exploitation; the realistic model is a targeted ICS engineer being induced to open a crafted project file. Verification gap: no fixed version is present in the supplied data, so remediation status must be confirmed against the CISA ICS advisory.

An attacker delivers a DAQFactory project file (.ctl) crafted to trigger the use-after-free, posing as an updated HMI screen or control configuration. When an engineer opens the file in DAQFactory on the workstation, the dangling pointer is exploited to execute attacker code in the application's context, establishing a foothold on the control-system host. Local attack vector plus required user interaction (AV:L/UI:A) means the attack hinges on social engineering rather than remote automation, and no public PoC has been identified at time of analysis.