Skip to content
OpenAdvisories
High ICSA-25-345-03 5 CVEs

AzeoTech DAQFactory (Update A)

Published Dec 11, 2025 · Updated Jan 12, 2026 · Revision 3

Vendor: AzeoTech Product: DAQFactory

Summary

Successful exploitation of these vulnerabilities requires an attacker to upload a malicious .ctl file. This could lead to information disclosure or arbitrary code execution.

Vulnerabilities 5

  • High 8.4
    CVE-2025-66589

    Out-of-bounds Read vulnerability in AzeoTech DAQFactory

    In AzeoTech DAQFactory release 20.7 (Build 2555), an Out-of-bounds Read vulnerability can be exploited by an attacker to cause the program to read data past the end of an allocated buffer. This could allow an attacker to disclose information or cause a system…

    AzeoTech DAQFactory
  • High 7.8
    CVE-2025-66585

    Use After Free vulnerability in AzeoTech DAQFactory

    In AzeoTech DAQFactory release 20.7 (Build 2555), a use after free vulnerability can be exploited to cause memory corruption while parsing specially crafted .ctl files. This could allow an attacker to execute code in the context of the current process.

    AzeoTech DAQFactory
  • High 7.8
    CVE-2025-66586

    Type Confusion vulnerability in AzeoTech DAQFactory

    In AzeoTech DAQFactory release 20.7 (Build 2555), an access of resource using incompatible type vulnerability can be exploited to cause memory corruption while parsing specially crafted .ctl files. This could allow an attacker to execute code in the context o…

    AzeoTech DAQFactory
  • High 7.8
    CVE-2025-66588

    Access of Uninitialized Pointer vulnerability in AzeoTech DAQFactory

    In AzeoTech DAQFactory release 20.7 (Build 2555), an access of uninitialized pointer vulnerability can be exploited by an attacker which can lead to arbitrary code execution.

    AzeoTech DAQFactory
  • High 7.8
    CVE-2025-66590

    Out-of-bounds Write vulnerability in AzeoTech DAQFactory

    In AzeoTech DAQFactory release 20.7 (Build 2555), an out-of-bounds write vulnerability can be exploited by an attacker to cause the program to write data past the end of an allocated memory buffer. This can lead to arbitrary code execution or a system crash.

    AzeoTech DAQFactory

Revision history

  1. #3

    Updated acknowledgments and revision history summary for Update A.

  2. #2

    Update A - Updated researcher section, removed CVE-2025-66584 and CVE-2025-66587 after additional analysis showed they are duplicative to other CVEs in the advisory.

  3. #1

    Initial Publication

References