CVE-2025-66589 is an out-of-bounds read in AzeoTech DAQFactory 20.7 Build 2555 and earlier, scored critical (CVSS 9.1) in the record. It can disclose memory or crash the program. CISA scores it lower. AzeoTech names DAQFactory Release 21.1 as the fix.
What's affected
AzeoTech DAQFactory release 20.7 (Build 2555) and earlier. CISA's advisory lists the affected range as 20.7 Build 2555 and below, and names DAQFactory Release 21.1 as the vendor fix.
CISA covers five CVEs in the same advisory (CVE-2025-66585, CVE-2025-66586, CVE-2025-66588, CVE-2025-66589 and CVE-2025-66590). They share the same trigger: opening a crafted .ctl document. The advisory says successful exploitation requires an attacker to get a malicious .ctl file loaded, which can lead to information disclosure or arbitrary code execution.
Severity differs between sources. The NVD record shows 9.1, critical, with a network vector. The CISA advisory lists this CVE with a CVSS 3.1 score of 7.8, high, using a local vector that needs user interaction. I cannot tell from the pages I fetched why the two differ, so plan against the stricter reading and still use the CISA mitigations, which assume a malicious document.
How to check if you're exposed
In DAQFactory, open the About dialog and read the release and build. Anything at or below 20.7 Build 2555 is in scope.
Then find where your .ctl documents come from and who can write to those folders. CISA's mitigation list focuses on this. On a Windows engineering workstation you can review folder permissions with:
icacls "D:\Path\To\Your\ctl-folder"
Replace the path with your document store. Look for write access granted to broad groups such as Users or Everyone.
What to do now
- Upgrade DAQFactory to Release 21.1, the vendor fix named in the CISA advisory.
- Store .ctl files in a folder that only administrators can write to.
- Do not open documents from unknown or untrusted sources.
- Use Safe Mode when loading documents that were out of your control, and apply a document editing password where possible.
- Keep control system networks off the internet and behind firewalls, following the CISA recommended practices.
Why it matters
The weakness is CWE-125, out-of-bounds read. The program reads past the end of an allocated buffer. The record says that can expose memory contents or crash the program.
Information disclosure from an engineering tool might sound minor, but memory can hold file paths, credentials for connected devices or other documents. A crash can also interrupt monitoring. Treat the read as a stepping stone and fix it with the other two DAQFactory issues in the same release. The record does not list this CVE as known exploited.
Quick check
Which severity should I use for ticketing?
Record the NVD score of 9.1 and the CISA score of 7.8, then prioritize by how your .ctl files are handled. If untrusted documents reach users, treat it as urgent.
Is there a workaround besides the upgrade?
CISA lists folder permissions, Safe Mode for outside documents and editing passwords as risk reducers.
Sources
Last reviewed: 18 October 2026.
