CVE-2025-66596: Yokogawa FAST/TOOLS XSS Vulnerability

CVE-2025-66596 Overview

A host header injection vulnerability has been identified in Yokogawa Electric Corporation's FAST/TOOLS industrial automation software. The product fails to properly validate request headers, allowing attackers to insert invalid host headers that can redirect users to malicious websites. This vulnerability (CWE-601: URL Redirection to Untrusted Site) poses a significant risk in industrial control system environments where FAST/TOOLS is deployed for process automation and monitoring.

Critical Impact
Attackers can exploit improper host header validation to redirect users to malicious sites, potentially leading to credential theft, phishing attacks, or malware distribution in industrial control system environments.

Affected Products

FAST/TOOLS Package: RVSVRN (R9.01 to R10.04)
FAST/TOOLS Package: UNSVRN (R9.01 to R10.04)
FAST/TOOLS Package: HMIWEB (R9.01 to R10.04)
FAST/TOOLS Package: FTEES (R9.01 to R10.04)
FAST/TOOLS Package: HMIMOB (R9.01 to R10.04)

Discovery Timeline

2026-02-09 - CVE-2025-66596 published to NVD
2026-02-09 - Last updated in NVD database

Technical Details for CVE-2025-66596

Vulnerability Analysis

This vulnerability exists within the request header processing mechanism of Yokogawa FAST/TOOLS. The application fails to implement adequate validation controls for the HTTP Host header, a critical security oversight that enables open redirect attacks. When processing incoming HTTP requests, the application trusts the Host header value without proper sanitization, allowing attackers to craft malicious requests that manipulate the redirect destination.

The vulnerability is classified under CWE-601 (URL Redirection to Untrusted Site), commonly known as an "Open Redirect" vulnerability. In the context of industrial control systems like FAST/TOOLS, this vulnerability is particularly concerning as it could be leveraged as part of a multi-stage attack against operators and engineers who access the HMI (Human Machine Interface) web components.

Root Cause

The root cause of this vulnerability is insufficient input validation on HTTP Host header values within the FAST/TOOLS web components. The application accepts and processes Host headers without verifying they correspond to legitimate, expected domains. This allows user-controlled input to influence redirect behavior, enabling attackers to construct URLs that appear to originate from the trusted FAST/TOOLS application but redirect victims to attacker-controlled destinations.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction from the perspective of the CVSS scoring. An attacker can exploit this vulnerability by crafting HTTP requests with malicious Host header values targeting the FAST/TOOLS web interface. When a victim clicks a link or is otherwise directed to the manipulated URL, they may be redirected to a phishing site designed to harvest credentials or deliver malware.

A typical exploitation scenario involves:

Attacker identifies a vulnerable FAST/TOOLS deployment accessible via the network
Attacker crafts a malicious URL with a manipulated Host header
Attacker distributes the malicious URL via phishing email or other social engineering tactics
Victim clicks the link, believing it leads to the legitimate FAST/TOOLS interface
Victim is redirected to an attacker-controlled site that mimics the FAST/TOOLS login page
Victim enters credentials, which are captured by the attacker

The vulnerability affects the web-facing components of FAST/TOOLS including HMIWEB and HMIMOB packages, which handle browser-based access to the industrial automation platform.

Detection Methods for CVE-2025-66596

Indicators of Compromise

HTTP requests to FAST/TOOLS web interfaces containing unexpected or external domains in the Host header
Redirect responses (HTTP 301/302) pointing to domains outside the organization's infrastructure
User reports of being redirected to suspicious sites when accessing FAST/TOOLS
Authentication logs showing login attempts from unexpected geographic locations after FAST/TOOLS access

Detection Strategies

Implement web application firewall (WAF) rules to detect and block requests with malformed or suspicious Host headers
Monitor HTTP access logs for requests containing Host headers that don't match expected FAST/TOOLS server names
Deploy network intrusion detection signatures to identify potential host header injection attempts
Review web server logs for patterns of redirect responses to external or unexpected domains

Monitoring Recommendations

Enable detailed HTTP request logging on FAST/TOOLS web server components
Configure SIEM alerts for anomalous redirect patterns from FAST/TOOLS endpoints
Implement user behavior analytics to detect credential theft following potential redirect attacks
Monitor for phishing campaigns that may leverage the organization's FAST/TOOLS domain in URLs

How to Mitigate CVE-2025-66596

Immediate Actions Required

Review the Yokogawa Security Advisory YSAR-26-0001-E for official guidance
Identify all FAST/TOOLS deployments running affected versions R9.01 through R10.04
Implement network segmentation to limit exposure of FAST/TOOLS web interfaces
Configure web server or reverse proxy to validate Host headers against an allowlist of expected values
Educate operators and engineers about the risk of phishing attacks leveraging this vulnerability

Patch Information

Yokogawa Electric Corporation has published security advisory YSAR-26-0001-E addressing this vulnerability. Organizations should consult the official advisory for specific patch information and update instructions. Contact Yokogawa support or your authorized FAST/TOOLS distributor for guidance on obtaining and applying the appropriate security update for your deployment.

Workarounds

Configure web server or reverse proxy to strictly validate the Host header against an allowlist of legitimate server names
Implement network access controls to restrict FAST/TOOLS web interface access to authorized internal networks only
Deploy a web application firewall (WAF) with rules to block requests containing unexpected Host header values
Consider disabling external access to HMIWEB and HMIMOB components until patches can be applied