Read the docs
TI-2025-40994 Aliases CVE-2025-66589GHSA-whf2-qv4m-gwqh

Out-of-bounds Read vulnerability in AzeoTech DAQFactory

Priority LOW 38CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

In AzeoTech DAQFactory release 20.7 (Build 2555), an Out-of-bounds Read vulnerability can be exploited by an attacker to cause the program to read data past the end of an allocated buffer. This could allow an attacker to disclose information or cause a system crash.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00354 29th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AzeoTechDAQFactoryup to Release 20.7 (Build 2555)—No fix listedCNA
  • DAQFactory VendorAzeoTech Affected up to Release 20.7 (Build 2555) Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:azeotech:daqfactory:*:*:*:*:*:*:*:*before 21.1VulnerableAzeoTech
  • cpe:2.3:a:azeotech:daqfactory:*:*:*:*:*:*:*:* Versions before 21.1 Vulnerable ·AzeoTech

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66589
  2. 2026-10-03 Alias added: GHSA-whf2-qv4m-gwqh

References

Advisory 1

  • TI-2011-03072 Stack-based buffer overflow in Azeotech DAQFactory 5.85 build 1853 and earlier allows… CVSS 2.0HIGH 10.0
  • TI-2009-04243 Buffer overflow in the web service in AzeoTech DAQFactory 5.77 might allow remote… CVSS 2.0HIGH 9.3
  • TI-2025-40995 Out-of-bounds Write vulnerability in AzeoTech DAQFactory CVSS 4.0HIGH 8.4
  • TI-2011-02608 AzeoTech DAQFactory before 5.85 (Build 1842) does not perform authentication for certain… CVSS 2.0HIGH 7.8
  • TI-2026-11003 Use after free in AzeoTech DAQFactory CVSS 4.0HIGH 8.4
  • TI-2026-10638 Access of resource using incompatible type ('type confusion') in AzeoTech DAQFactory CVSS 4.0HIGH 8.4
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences