CVE-2025-66586 | THREATINT

Description

In AzeoTech DAQFactory release 20.7 (Build 2555), an Access of Resource Using Incompatible Type vulnerability can be exploited to cause memory corruption while parsing specially crafted .ctl files. This could allow an attacker to execute code in the context of the current process.

PUBLISHED Reserved 2025-12-04 | Published 2025-12-11 | Updated 2025-12-30 | Assigner icscert

HIGH: 7.3CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

Product status

Default status

unaffected

Any version

affected

Credits

Rocco Calvi (@TecR0c) with TecSecurity of Trend Zero Day Initiative finder

Andrea Micalizzi (@rgod777) of Trend Zero Day Initiative finder

References

www.cisa.gov/news-events/ics-advisories/icsa-25-345-03 government-resource

cve.org (CVE-2025-66586)

nvd.nist.gov (CVE-2025-66586)

Download JSON