CVE-2025-66606 is a critical flaw (CVSS 9.6) in Yokogawa FAST/TOOLS R9.01 to R10.04. The product does not properly encode URLs, so an attacker could tamper with web pages or run malicious scripts in a user's browser. The record names no fixed version. Use advisory YSAR-26-0001.
What's affected
- Yokogawa FAST/TOOLS packages RVSVRN, UNSVRN, HMIWEB, FTEES and HMIMOB.
- Versions R9.01 to R10.04.
- Fixed version: not stated in the record. Check YSAR-26-0001.
How to check if you're exposed
Confirm your FAST/TOOLS release and package list. If you run any of the five packages between R9.01 and R10.04, treat the server as affected until Yokogawa's advisory says otherwise.
The vector requires user interaction, which means an operator has to open a crafted link. Ask who uses the web interface, and whether those users also browse the internet or read email from the same workstations.
What to do now
- Inventory FAST/TOOLS installations and releases.
- Apply the remediation in YSAR-26-0001.
- Tell operators not to open FAST/TOOLS links from email or chat.
- Use separate workstations for plant interfaces and general browsing where you can.
- Add a content security policy at a reverse proxy if the product sits behind one and the advisory allows it.
Cross site scripting is easier to contain when the browser has fewer chances to run foreign script. Even without a product fix, a strict content security policy at a reverse proxy, separate browser profiles for plant tools, and a short list of allowed links all reduce the chance that an operator opens something harmful.
Why it matters
The record maps this to CWE-86, improper neutralization of invalid characters in identifiers in web pages. Data from a URL is placed in a page without being encoded, so the browser may treat it as code.
The scope change in the vector reflects that script runs in the operator's browser session, not on the server. In an industrial setting that session may be able to issue commands. The record does not list this CVE as exploited in the wild.
Quick check
Why does CVE-2025-66606 need user interaction?
The attacker needs a user to load a crafted URL, after which the unencoded data can run as script in that user's browser.
Sources
Last reviewed: 19 October 2026.
