Read the docs
TI-2025-40995 Aliases CVE-2025-66590GHSA-v7vg-99h9-jhcw

Out-of-bounds Write vulnerability in AzeoTech DAQFactory

Priority MEDIUM 45CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

In AzeoTech DAQFactory release 20.7 (Build 2555), an out-of-bounds write vulnerability can be exploited by an attacker to cause the program to write data past the end of an allocated memory buffer. This can lead to arbitrary code execution or a system crash.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0038 32nd percentileScored 2026-11-07
Fix Fixed DAQFactory (AzeoTech): Release 21.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AzeoTechDAQFactoryup to Release 20.7 (Build 2555)Release 21.1Patch availableCNA
  • DAQFactory VendorAzeoTech Affected up to Release 20.7 (Build 2555) Fixed in Release 21.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:azeotech:daqfactory:*:*:*:*:*:*:*:*before 21.1VulnerableAzeoTech
  • cpe:2.3:a:azeotech:daqfactory:*:*:*:*:*:*:*:* Versions before 21.1 Vulnerable ·AzeoTech

Remediation

  • Fix · CNA DAQFactory (AzeoTech) Fixed in Release 21.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66590
  2. 2026-10-03 Alias added: GHSA-v7vg-99h9-jhcw

References

Advisory 1

Other 1

  • TI-2011-03072 Stack-based buffer overflow in Azeotech DAQFactory 5.85 build 1853 and earlier allows… CVSS 2.0HIGH 10.0
  • TI-2009-04243 Buffer overflow in the web service in AzeoTech DAQFactory 5.77 might allow remote… CVSS 2.0HIGH 9.3
  • TI-2011-02608 AzeoTech DAQFactory before 5.85 (Build 1842) does not perform authentication for certain… CVSS 2.0HIGH 7.8
  • TI-2026-11003 Use after free in AzeoTech DAQFactory CVSS 4.0HIGH 8.4
  • TI-2026-10638 Access of resource using incompatible type ('type confusion') in AzeoTech DAQFactory CVSS 4.0HIGH 8.4
  • TI-2025-40994 Out-of-bounds Read vulnerability in AzeoTech DAQFactory CVSS 4.0HIGH 8.4
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences