CVE-2025-66588 - Vulnerability Details - OpenCVE

In AzeoTech DAQFactory release 20.7 (Build 2555), an Access of Uninitialized Pointer vulnerability can be exploited by an attacker which can lead to arbitrary code execution.

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Azeotech	Daqfactory

No data.

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-03

History

Fri, 12 Dec 2025 09:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Azeotech Azeotech daqfactory
Vendors & Products		Azeotech Azeotech daqfactory

Thu, 11 Dec 2025 21:00:00 +0000

Type	Values Removed	Values Added
Description		In AzeoTech DAQFactory release 20.7 (Build 2555), an Access of Uninitialized Pointer vulnerability can be exploited by an attacker which can lead to arbitrary code execution.
Title		Access of Uninitialized Pointer vulnerability in AzeoTech DAQFactory
Weaknesses		CWE-824
References		https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-03
Metrics		cvssV4_0 `{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2025-12-11T20:50:39.132Z

Updated: 2025-12-11T20:50:39.132Z

Reserved: 2025-12-04T21:11:02.201Z

Link: CVE-2025-66588

Vulnrichment

No data.

NVD

Status : Undergoing Analysis

Published: 2025-12-11T21:15:57.907

Modified: 2025-12-12T15:17:31.973

Link: CVE-2025-66588

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-66588", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2025-12-04T21:11:02.201Z", "datePublished": "2025-12-11T20:50:39.132Z", "dateUpdated": "2025-12-11T20:50:39.132Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "DAQFactory", "vendor": "AzeoTech", "versions": [{"lessThanOrEqual": "Release 20.7 (Build 2555)", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Heinzl"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p></p>\n\n<p></p>\n\n<p>In AzeoTech DAQFactory release 20.7 (Build 2555), an Access of Uninitialized Pointer vulnerability can be exploited by an attacker which can lead to arbitrary code execution.</p>\n\n<br>\n\n<br>"}], "value": "In AzeoTech DAQFactory release 20.7 (Build 2555), an Access of Uninitialized Pointer vulnerability can be exploited by an attacker which can lead to arbitrary code execution."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.4, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-824", "description": "CWE-824 Access of Uninitialized Pointer", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-12-11T20:50:39.132Z"}, "references": [{"tags": ["government-resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-03"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>AzeoTech has released the following update that addresses these issues:</p><ul><li>DAQFactory: Release 21.1</li></ul><p>AzeoTech also recommends users take the following actions to reduce the risk:</p><ul><li>Users are discouraged from using documents from unknown/untrusted sources.</li><li>Users are encouraged to store .ctl files in a folder only writeable by admin-level users.</li><li>Users are encouraged to operate in \u201cSafe Mode\u201d when loading documents that have been out of their control.</li><li>Users are encouraged to apply a document editing password to their documents.</li></ul>\n\n<br>"}], "value": "AzeoTech has released the following update that addresses these issues:\n\n * DAQFactory: Release 21.1\n\n\nAzeoTech also recommends users take the following actions to reduce the risk:\n\n * Users are discouraged from using documents from unknown/untrusted sources.\n * Users are encouraged to store .ctl files in a folder only writeable by admin-level users.\n * Users are encouraged to operate in \u201cSafe Mode\u201d when loading documents that have been out of their control.\n * Users are encouraged to apply a document editing password to their documents."}], "source": {"discovery": "UNKNOWN"}, "title": "Access of Uninitialized Pointer vulnerability in AzeoTech DAQFactory", "x_generator": {"engine": "Vulnogram 0.5.0"}}}}