CVE-2025-66590 is a high severity (CVSS 7.8) out-of-bounds write in AzeoTech DAQFactory 20.7 Build 2555 and earlier. A crafted document can overwrite memory and lead to code execution or a crash on the workstation. AzeoTech names DAQFactory Release 21.1 as the fix.
What's affected
AzeoTech DAQFactory release 20.7 (Build 2555) and earlier. CISA's advisory lists the affected range as 20.7 Build 2555 and below, and names DAQFactory Release 21.1 as the vendor fix.
CISA covers five CVEs in the same advisory (CVE-2025-66585, CVE-2025-66586, CVE-2025-66588, CVE-2025-66589 and CVE-2025-66590). They share the same trigger: opening a crafted .ctl document. The advisory says successful exploitation requires an attacker to get a malicious .ctl file loaded, which can lead to information disclosure or arbitrary code execution.
How to check if you're exposed
In DAQFactory, open the About dialog and read the release and build. Anything at or below 20.7 Build 2555 is in scope.
Then find where your .ctl documents come from and who can write to those folders. CISA's mitigation list focuses on this. On a Windows engineering workstation you can review folder permissions with:
icacls "D:\Path\To\Your\ctl-folder"
Replace the path with your document store. Look for write access granted to broad groups such as Users or Everyone.
What to do now
- Upgrade DAQFactory to Release 21.1, the vendor fix named in the CISA advisory.
- Store .ctl files in a folder that only administrators can write to.
- Do not open documents from unknown or untrusted sources.
- Use Safe Mode when loading documents that were out of your control, and apply a document editing password where possible.
- Keep control system networks off the internet and behind firewalls, following the CISA recommended practices.
Why it matters
The weakness is CWE-787, out-of-bounds write. Data lands past the end of an allocated buffer, which can corrupt neighboring memory. Memory corruption bugs of this kind are among the most common routes to code execution in native software.
CISA's scoring uses a local vector with user interaction and high impact on confidentiality, integrity and availability, which gives 7.8. In practice that means the key control is document hygiene. If only trusted administrators can place .ctl files where operators open them, the practical risk drops a lot, though the upgrade is still the real fix. The record does not mark this as known exploited.
Quick check
Do all five DAQFactory CVEs have the same fix?
CISA lists DAQFactory Release 21.1 as the vendor fix across the advisory.
Why does a file based bug matter on a plant network?
Documents move by email, shares and removable media, and engineering workstations often sit close to control systems.
Sources
Last reviewed: 18 October 2026.
