EUVD-2026-39513
GHSA-3mp5-47hq-xq78
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file-open vector (AV:L) with mandatory operator action (UI:R) and no prior privileges (PR:N); code execution yields full C/I/A impact in an unchanged scope.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
1DescriptionCVE.org
In AzeoTech DAQFactory versions 21.1 and prior, a Use After Free vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.
AnalysisAI
Arbitrary code execution in AzeoTech DAQFactory (versions 21.1 and prior) arises from a use-after-free flaw triggered when the application parses a maliciously crafted .ctl project/control file. An attacker who can convince an operator to open a booby-trapped .ctl file can corrupt memory and run code in the context of the DAQFactory process on the engineering or HMI workstation. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but it carries a high CVSS 4.0 base score of 8.4 driven by full confidentiality, integrity, and availability impact.
Technical ContextAI
DAQFactory is a Windows-based HMI/SCADA and data-acquisition runtime used to build operator interfaces, alarms, logging, and device communication in industrial control environments. The vulnerability is a CWE-416 Use After Free: the application continues to reference a heap object after it has been freed while loading/deserializing a .ctl file (DAQFactory's control/project document format). When attacker-controlled data influences the freed-then-reused allocation, the dangling pointer can be steered to attacker-supplied data, converting memory corruption into control-flow hijack and code execution. The CPE cpe:2.3:a:azeotech:daqfactory confirms the affected component is the DAQFactory application itself rather than a bundled third-party library.
RemediationAI
No vendor-released patch version is identified in the available data, so the fixed release must be confirmed directly from AzeoTech and the CISA ICS advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-02 (ICSA-26-169-02); upgrade to the vendor-designated fixed version once confirmed. As compensating controls until patching, treat .ctl files as untrusted executable content: only open project/control files from known-good, integrity-verified sources and block delivery of .ctl files via email and web gateways (trade-off: friction when legitimately exchanging project files). Restrict who can place files on engineering/HMI workstations and apply application allowlisting and least-privilege so a DAQFactory compromise does not yield broader host control. Isolate DAQFactory hosts on a segmented OT network without general internet or email access to reduce the chance an operator ever receives and opens a malicious file.
More in Daqfactory
View allCode execution in AzeoTech DAQFactory versions 21.1 and prior is achievable when a user opens a maliciously crafted .ctl
Out-of-bounds write in AzeoTech DAQFactory release 20.7 (Build 2555) enables arbitrary code execution or denial of servi
Arbitrary code execution in AzeoTech DAQFactory release 20.7 (Build 2555) is possible when a local user opens or interac
Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized ag
The affected application uses specific functions that could be abused through a crafted project file, which could lead t
Type confusion in AzeoTech DAQFactory 20.7 (Build 2555) enables arbitrary code execution when a user opens a maliciously
Local code execution in AzeoTech DAQFactory release 20.7 (Build 2555) is possible when a user opens a maliciously crafte
An Incorrect Default Permissions issue was discovered in AzeoTech DAQFactory versions prior to 17.1. Rated high severity
An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and tr
The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP. Rated medium severity
An Uncontrolled Search Path Element issue was discovered in AzeoTech DAQFactory versions prior to 17.1. Rated medium sev
Same weakness CWE-416 – Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today