CVE-2025-66608
📋 TL;DR
A path traversal vulnerability in Yokogawa's FAST/TOOLS software allows attackers to bypass URL validation and access arbitrary files on the web server. This affects FAST/TOOLS packages RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB from versions R9.01 through R10.04.
💻 Affected Systems
- FAST/TOOLS RVSVRN
- FAST/TOOLS UNSVRN
- FAST/TOOLS HMIWEB
- FAST/TOOLS FTEES
- FAST/TOOLS HMIMOB
📦 What is this software?
Fast\/tools by Yokogawa
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of sensitive files including configuration files, credentials, and proprietary data leading to system takeover or industrial espionage.
Likely Case
Unauthorized access to configuration files, logs, and potentially sensitive operational data stored on the web server.
If Mitigated
Limited file access restricted by proper input validation and file system permissions.
🎯 Exploit Status
Exploitation requires sending specially crafted HTTP requests but no authentication is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: R10.04 with security patch or later versions
Vendor Advisory: https://web-material3.yokogawa.com/1/39206/files/YSAR-26-0001-E.pdf
Restart Required: Yes
Instructions:
1. Download the security patch from Yokogawa support portal. 2. Apply the patch following vendor instructions. 3. Restart affected FAST/TOOLS services. 4. Verify the fix by testing URL validation.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to FAST/TOOLS web interfaces using firewalls.
Web Application Firewall
allDeploy WAF with path traversal protection rules to block malicious requests.
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to trusted sources only.
- Monitor web server logs for unusual file access patterns and path traversal attempts.
🔍 How to Verify
Check if Vulnerable:
Check FAST/TOOLS version via administrative interface or configuration files. Versions R9.01 through R10.04 are vulnerable.Check Version:
Check version in FAST/TOOLS administration console or configuration files (specific command depends on installation).Verify Fix Applied:
Test URL validation by attempting path traversal requests after patch application. Successful requests should be blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' sequences
- Unusual file access patterns from web server process
- Access to files outside expected web directories
Network Indicators:
- HTTP requests with encoded path traversal sequences (%2e%2e%2f)
- Multiple failed attempts to access sensitive file paths
SIEM Query:
source="web_server" AND (url="*../*" OR url="*..%2f*" OR url="*%2e%2e%2f*")