CVE-2025-66596 Overview
A host header injection vulnerability has been identified in Yokogawa Electric Corporation's FAST/TOOLS industrial automation software. The product fails to properly validate request headers, allowing attackers to insert invalid host headers that can redirect users to malicious websites. This vulnerability (CWE-601: URL Redirection to Untrusted Site) poses a significant risk in industrial control system environments where FAST/TOOLS is deployed for process automation and monitoring.
Critical Impact
Attackers can exploit improper host header validation to redirect users to malicious sites, potentially leading to credential theft, phishing attacks, or malware distribution in industrial control system environments.
Affected Products
- FAST/TOOLS Package: RVSVRN (R9.01 to R10.04)
- FAST/TOOLS Package: UNSVRN (R9.01 to R10.04)
- FAST/TOOLS Package: HMIWEB (R9.01 to R10.04)
- FAST/TOOLS Package: FTEES (R9.01 to R10.04)
- FAST/TOOLS Package: HMIMOB (R9.01 to R10.04)
Discovery Timeline
- 2026-02-09 - CVE-2025-66596 published to NVD
- 2026-02-09 - Last updated in NVD database
Technical Details for CVE-2025-66596
Vulnerability Analysis
This vulnerability exists within the request header processing mechanism of Yokogawa FAST/TOOLS. The application fails to implement adequate validation controls for the HTTP Host header, a critical security oversight that enables open redirect attacks. When processing incoming HTTP requests, the application trusts the Host header value without proper sanitization, allowing attackers to craft malicious requests that manipulate the redirect destination.
The vulnerability is classified under CWE-601 (URL Redirection to Untrusted Site), commonly known as an "Open Redirect" vulnerability. In the context of industrial control systems like FAST/TOOLS, this vulnerability is particularly concerning as it could be leveraged as part of a multi-stage attack against operators and engineers who access the HMI (Human Machine Interface) web components.
Root Cause
The root cause of this vulnerability is insufficient input validation on HTTP Host header values within the FAST/TOOLS web components. The application accepts and processes Host headers without verifying they correspond to legitimate, expected domains. This allows user-controlled input to influence redirect behavior, enabling attackers to construct URLs that appear to originate from the trusted FAST/TOOLS application but redirect victims to attacker-controlled destinations.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction from the perspective of the CVSS scoring. An attacker can exploit this vulnerability by crafting HTTP requests with malicious Host header values targeting the FAST/TOOLS web interface. When a victim clicks a link or is otherwise directed to the manipulated URL, they may be redirected to a phishing site designed to harvest credentials or deliver malware.
A typical exploitation scenario involves:
- Attacker identifies a vulnerable FAST/TOOLS deployment accessible via the network
- Attacker crafts a malicious URL with a manipulated Host header
- Attacker distributes the malicious URL via phishing email or other social engineering tactics
- Victim clicks the link, believing it leads to the legitimate FAST/TOOLS interface
- Victim is redirected to an attacker-controlled site that mimics the FAST/TOOLS login page
- Victim enters credentials, which are captured by the attacker
The vulnerability affects the web-facing components of FAST/TOOLS including HMIWEB and HMIMOB packages, which handle browser-based access to the industrial automation platform.
Detection Methods for CVE-2025-66596
Indicators of Compromise
- HTTP requests to FAST/TOOLS web interfaces containing unexpected or external domains in the Host header
- Redirect responses (HTTP 301/302) pointing to domains outside the organization's infrastructure
- User reports of being redirected to suspicious sites when accessing FAST/TOOLS
- Authentication logs showing login attempts from unexpected geographic locations after FAST/TOOLS access
Detection Strategies
- Implement web application firewall (WAF) rules to detect and block requests with malformed or suspicious Host headers
- Monitor HTTP access logs for requests containing Host headers that don't match expected FAST/TOOLS server names
- Deploy network intrusion detection signatures to identify potential host header injection attempts
- Review web server logs for patterns of redirect responses to external or unexpected domains
Monitoring Recommendations
- Enable detailed HTTP request logging on FAST/TOOLS web server components
- Configure SIEM alerts for anomalous redirect patterns from FAST/TOOLS endpoints
- Implement user behavior analytics to detect credential theft following potential redirect attacks
- Monitor for phishing campaigns that may leverage the organization's FAST/TOOLS domain in URLs
How to Mitigate CVE-2025-66596
Immediate Actions Required
- Review the Yokogawa Security Advisory YSAR-26-0001-E for official guidance
- Identify all FAST/TOOLS deployments running affected versions R9.01 through R10.04
- Implement network segmentation to limit exposure of FAST/TOOLS web interfaces
- Configure web server or reverse proxy to validate Host headers against an allowlist of expected values
- Educate operators and engineers about the risk of phishing attacks leveraging this vulnerability
Patch Information
Yokogawa Electric Corporation has published security advisory YSAR-26-0001-E addressing this vulnerability. Organizations should consult the official advisory for specific patch information and update instructions. Contact Yokogawa support or your authorized FAST/TOOLS distributor for guidance on obtaining and applying the appropriate security update for your deployment.
Workarounds
- Configure web server or reverse proxy to strictly validate the Host header against an allowlist of legitimate server names
- Implement network access controls to restrict FAST/TOOLS web interface access to authorized internal networks only
- Deploy a web application firewall (WAF) with rules to block requests containing unexpected Host header values
- Consider disabling external access to HMIWEB and HMIMOB components until patches can be applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
