CVE-2025-66588 is a high severity (CVSS 7.8) access of uninitialized pointer flaw in AzeoTech DAQFactory 20.7 Build 2555 and earlier. Opening a crafted .ctl document can lead to arbitrary code execution on the workstation. AzeoTech names DAQFactory Release 21.1 as the fix.
What's affected
AzeoTech DAQFactory release 20.7 (Build 2555) and earlier. CISA's advisory lists the affected range as 20.7 Build 2555 and below, and names DAQFactory Release 21.1 as the vendor fix.
CISA covers five CVEs in the same advisory (CVE-2025-66585, CVE-2025-66586, CVE-2025-66588, CVE-2025-66589 and CVE-2025-66590). They share the same trigger: opening a crafted .ctl document. The advisory says successful exploitation requires an attacker to get a malicious .ctl file loaded, which can lead to information disclosure or arbitrary code execution.
How to check if you're exposed
In DAQFactory, open the About dialog and read the release and build. Anything at or below 20.7 Build 2555 is in scope.
Then find where your .ctl documents come from and who can write to those folders. CISA's mitigation list focuses on this. On a Windows engineering workstation you can review folder permissions with:
icacls "D:\Path\To\Your\ctl-folder"
Replace the path with your document store. Look for write access granted to broad groups such as Users or Everyone.
What to do now
- Upgrade DAQFactory to Release 21.1, the vendor fix named in the CISA advisory.
- Store .ctl files in a folder that only administrators can write to.
- Do not open documents from unknown or untrusted sources.
- Use Safe Mode when loading documents that were out of your control, and apply a document editing password where possible.
- Keep control system networks off the internet and behind firewalls, following the CISA recommended practices.
Why it matters
DAQFactory is data acquisition and control software used in industrial settings, and CISA lists critical manufacturing as the affected sector. The weakness is CWE-824, access of an uninitialized pointer. The program uses a memory reference before it has been given a valid value, and a crafted document can steer what happens next.
The attack vector is local with user interaction, which matches the 7.8 score. That is lower than a network flaw, but engineering workstations often exchange documents by email, shared drives and removable media. Those habits are what turn a file based bug into a plant floor risk. The record does not flag this CVE as known exploited.
Quick check
Can this be reached from the internet?
CISA describes the attack as requiring a malicious .ctl file to be loaded. The score reflects a local vector with user interaction.
Is there a fix?
Yes, CISA lists DAQFactory Release 21.1 as the vendor fix.
Sources
Last reviewed: 18 October 2026.
