CVE-2025-66603 affects Yokogawa FAST/TOOLS R9.01 to R10.04. The web server accepts the HTTP OPTIONS method, which can give an attacker information to plan other attacks. NVD scores it 9.8, critical. The record gives no fixed version, so follow Yokogawa advisory YSAR-26-0001.
What's affected
- Yokogawa FAST/TOOLS packages RVSVRN, UNSVRN, HMIWEB, FTEES and HMIMOB.
- Versions R9.01 to R10.04.
- Fixed version: not stated in the record. Check YSAR-26-0001.
How to check if you're exposed
Confirm your release and packages as for any FAST/TOOLS server. To see whether the web server answers OPTIONS, send an OPTIONS request to a server you own and read the Allow header in the response. A response that lists methods means the server accepts it.
The score here is far higher than the description suggests, since the text only describes information disclosure. Treat the advisory as the authority on impact and remediation.
What to do now
- List FAST/TOOLS servers and their releases.
- Read YSAR-26-0001 and apply Yokogawa's remediation.
- Where the product supports it, restrict allowed HTTP methods at a reverse proxy in front of the server.
- Keep the server on a segmented network.
- Handle this together with the other CVEs in the same Yokogawa advisory.
Disabling methods at a proxy is a common hardening step for web services, but it does not change what the product itself does. Keep any proxy rule as a temporary layer. Ask your Yokogawa contact whether the advisory's update is available for your exact release, and plan the change with the operations team.
Why it matters
The record maps this to CWE-358, an improperly implemented security check for a standard. In practice the server answers a method that exposes details about what it supports, which helps someone plan a more targeted request.
By itself that is reconnaissance. It matters because the same advisory covers other flaws in the same product, and exposure of a server to many probes makes each small leak more useful. The record does not list this CVE as exploited in the wild.
Quick check
What does accepting the OPTIONS method reveal?
It reveals which HTTP methods the server supports. Yokogawa says an attacker could use that information to carry out other attacks.
Sources
Last reviewed: 19 October 2026.
