CVE-2025-66602 is a critical flaw (CVSS 9.8) in Yokogawa FAST/TOOLS R9.01 to R10.04. The web server accepts access by IP address, so a worm scanning random addresses could reach it. The record names no fixed version, so use Yokogawa advisory YSAR-26-0001.
What's affected
- Yokogawa FAST/TOOLS packages RVSVRN, UNSVRN, HMIWEB, FTEES and HMIMOB.
- Versions R9.01 to R10.04.
- Fixed version: not stated in the record. Check YSAR-26-0001.
How to check if you're exposed
Identify FAST/TOOLS servers and read the installed release and package list from your system documentation or the product's version information. Anything from R9.01 through R10.04 with one of the five packages is in scope.
Then check how the web server is reachable. Can a client open it by IP address from outside the intended network segment? Test from a segment where it should not be reachable.
What to do now
- List all FAST/TOOLS installations and their release and packages.
- Open advisory YSAR-26-0001 and apply the remediation Yokogawa lists for your release.
- Make sure the web server is not reachable from corporate or internet networks except through a controlled path.
- Segment the control network and keep general scanning traffic out.
- Monitor for unexpected connections to the web server.
Industrial sites often cannot patch on short notice, since a restart can affect production. That is why the network controls above carry weight. Document what you did as a compensating control, write down the date you expect to apply the vendor update, and revisit the decision when that date arrives.
Why it matters
The record classifies this as CWE-291, reliance on an IP address for authentication. Trusting where a request comes from, rather than who sent it, fails once an unexpected host can reach the service.
Yokogawa describes the risk as worm exposure: malware that picks addresses at random can find a server that answers on its IP. Industrial networks that are flat make that realistic. The record does not list this CVE as exploited in the wild.
Quick check
Is there a fixed FAST/TOOLS version in the CVE record?
No. The record lists affected versions only. Check Yokogawa advisory YSAR-26-0001 for remediation.
Sources
Last reviewed: 19 October 2026.
