CVE-2025-66596
📋 TL;DR
A host header injection vulnerability in Yokogawa FAST/TOOLS allows attackers to redirect users to malicious websites by manipulating request headers. This affects FAST/TOOLS packages RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB from versions R9.01 through R10.04.
💻 Affected Systems
- FAST/TOOLS RVSVRN
- FAST/TOOLS UNSVRN
- FAST/TOOLS HMIWEB
- FAST/TOOLS FTEES
- FAST/TOOLS HMIMOB
📦 What is this software?
Fast\/tools by Yokogawa
⚠️ Risk & Real-World Impact
Worst Case
Users could be redirected to phishing sites that steal credentials or deliver malware, potentially leading to full system compromise.
Likely Case
Attackers redirect users to malicious sites for credential harvesting or malware distribution.
If Mitigated
With proper network segmentation and user awareness, impact is limited to potential phishing attempts.
🎯 Exploit Status
Exploitation requires network access to the vulnerable service but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: R10.04 with security patch or later versions
Vendor Advisory: https://web-material3.yokogawa.com/1/39206/files/YSAR-26-0001-E.pdf
Restart Required: Yes
Instructions:
1. Download the security patch from Yokogawa support. 2. Apply the patch according to vendor documentation. 3. Restart affected services. 4. Verify the fix is applied.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to FAST/TOOLS services to trusted networks only.
Reverse Proxy Validation
allConfigure reverse proxies to validate and sanitize host headers before forwarding to FAST/TOOLS.
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure.
- Deploy web application firewall rules to detect and block malicious host headers.
🔍 How to Verify
Check if Vulnerable:
Check FAST/TOOLS version against affected range (R9.01 to R10.04) and verify if security patches are applied.Check Version:
Consult FAST/TOOLS documentation or system administration interface for version information.Verify Fix Applied:
Confirm installation of security patch from vendor advisory and test that invalid host headers no longer cause redirects.📡 Detection & Monitoring
Log Indicators:
- Unusual host header values in web server logs
- Multiple redirect requests from single sources
Network Indicators:
- HTTP requests with manipulated host headers
- Unexpected redirects to external domains
SIEM Query:
web_access_logs host_header CONTAINS malicious_domain OR redirect_status = 302 AND dest_ip NOT IN trusted_networks