Read the docs
TI-2025-40992 Aliases CVE-2025-66586GHSA-hv2x-9wmr-25wf

Type Confusion vulnerability in AzeoTech DAQFactory

Priority LOW 33CWE-843Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-843 and the CVSS impact.

Summary

In AzeoTech DAQFactory release 20.7 (Build 2555), an access of resource using incompatible type vulnerability can be exploited to cause memory corruption while parsing specially crafted .ctl files. This could allow an attacker to execute code in the context of the current process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00219 12th percentileScored 2026-11-07
Fix Fixed DAQFactory (AzeoTech): Release 21.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AzeoTechDAQFactoryup to Release 20.7 (Build 2555)Release 21.1Patch availableCNA
  • DAQFactory VendorAzeoTech Affected up to Release 20.7 (Build 2555) Fixed in Release 21.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:azeotech:daqfactory:*:*:*:*:*:*:*:*before 21.1VulnerableAzeoTech
  • cpe:2.3:a:azeotech:daqfactory:*:*:*:*:*:*:*:* Versions before 21.1 Vulnerable ·AzeoTech

Remediation

  • Fix · CNA DAQFactory (AzeoTech) Fixed in Release 21.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66586
  2. 2026-10-03 Alias added: GHSA-hv2x-9wmr-25wf

References

Advisory 1

Other 1

  • TI-2011-03072 Stack-based buffer overflow in Azeotech DAQFactory 5.85 build 1853 and earlier allows… CVSS 2.0HIGH 10.0
  • TI-2009-04243 Buffer overflow in the web service in AzeoTech DAQFactory 5.77 might allow remote… CVSS 2.0HIGH 9.3
  • TI-2025-40995 Out-of-bounds Write vulnerability in AzeoTech DAQFactory CVSS 4.0HIGH 8.4
  • TI-2011-02608 AzeoTech DAQFactory before 5.85 (Build 1842) does not perform authentication for certain… CVSS 2.0HIGH 7.8
  • TI-2026-11003 Use after free in AzeoTech DAQFactory CVSS 4.0HIGH 8.4
  • TI-2026-10638 Access of resource using incompatible type ('type confusion') in AzeoTech DAQFactory CVSS 4.0HIGH 8.4
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences