CVE-2025-66585
📋 TL;DR
A Use After Free vulnerability in AzeoTech DAQFactory allows attackers to execute arbitrary code by tricking users into opening malicious .ctl files. This affects all users of DAQFactory 20.7 Build 2555 who process untrusted configuration files. Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- AzeoTech DAQFactory
📦 What is this software?
Daqfactory by Azeotech
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with SYSTEM/root privileges leading to full system compromise, data theft, and lateral movement within the network.
Likely Case
Local privilege escalation or code execution in the context of the DAQFactory process, potentially allowing attackers to manipulate industrial control systems.
If Mitigated
Denial of service or application crash if memory corruption occurs but code execution fails.
🎯 Exploit Status
Exploitation requires user interaction to open malicious files. No public exploits available as of advisory publication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to version 20.8 or later
Vendor Advisory: https://www.azeotech.com/support/security-advisories/
Restart Required: Yes
Instructions:
1. Download latest DAQFactory version from vendor website
2. Run installer with administrative privileges
3. Restart all DAQFactory services and applications
🔧 Temporary Workarounds
Restrict .ctl file handling
windowsBlock execution of .ctl files from untrusted sources and implement file integrity monitoring
Application whitelisting
windowsImplement application control to prevent unauthorized DAQFactory execution
🧯 If You Can't Patch
- Implement strict access controls to prevent untrusted users from uploading or modifying .ctl files
- Deploy endpoint detection and response (EDR) solutions to monitor for memory corruption attempts
🔍 How to Verify
Check if Vulnerable:
Check DAQFactory version in Help > About menu. If version is 20.7 Build 2555, system is vulnerable.Check Version:
Not applicable - check via GUI Help > About menuVerify Fix Applied:
Verify version is 20.8 or later in Help > About menu and test .ctl file parsing functionality.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected .ctl file access from unusual locations
- Process creation from DAQFactory with unusual parameters
Network Indicators:
- File transfers of .ctl files to DAQFactory systems
- Unusual network connections originating from DAQFactory process
SIEM Query:
EventID=1000 OR EventID=1001 Source='DAQFactory' AND (ExceptionCode=0xc0000005 OR ExceptionCode=0xc0000374)