CVE-2025-66595
📋 TL;DR
A Cross-Site Request Forgery (CSRF) vulnerability in Yokogawa's FAST/TOOLS industrial control system allows attackers to compromise user accounts when victims click malicious links. This affects multiple FAST/TOOLS components (RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) from versions R9.01 to R10.04. Industrial operators using these systems are at risk of unauthorized actions being performed on their behalf.
💻 Affected Systems
- FAST/TOOLS RVSVRN
- FAST/TOOLS UNSVRN
- FAST/TOOLS HMIWEB
- FAST/TOOLS FTEES
- FAST/TOOLS HMIMOB
📦 What is this software?
Fast\/tools by Yokogawa
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of operator accounts leading to unauthorized control system changes, process manipulation, safety system overrides, or industrial sabotage.
Likely Case
Unauthorized configuration changes, data manipulation, or privilege escalation within the FAST/TOOLS environment.
If Mitigated
Limited impact with proper CSRF protections, network segmentation, and user awareness training.
🎯 Exploit Status
CSRF attacks require user interaction (clicking malicious link) but are technically simple to implement. No public exploit code is mentioned in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: R10.04 or later with security updates
Vendor Advisory: https://web-material3.yokogawa.com/1/39206/files/YSAR-26-0001-E.pdf
Restart Required: Yes
Instructions:
1. Download security updates from Yokogawa support portal. 2. Apply updates to all affected FAST/TOOLS components. 3. Restart affected services. 4. Verify all components are running patched versions.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd anti-CSRF tokens to web forms and validate them server-side
Configuration specific to FAST/TOOLS - consult vendor documentation
SameSite Cookie Attribute
allConfigure cookies with SameSite=Strict or Lax attributes
Set-Cookie: session=value; SameSite=Strict; Secure; HttpOnly
🧯 If You Can't Patch
- Segment FAST/TOOLS systems on isolated networks with no internet access
- Implement strict access controls and user awareness training about phishing risks
🔍 How to Verify
Check if Vulnerable:
Check FAST/TOOLS version via system administration interface or configuration filesCheck Version:
Check version in FAST/TOOLS administration console or configuration filesVerify Fix Applied:
Verify version is R10.04 or later with security updates applied📡 Detection & Monitoring
Log Indicators:
- Unexpected configuration changes
- Unauthorized user actions
- Multiple failed login attempts followed by successful login
Network Indicators:
- Unusual HTTP POST requests to FAST/TOOLS endpoints
- Requests missing CSRF tokens
SIEM Query:
source="fast_tools" AND (action="config_change" OR user="unknown")