CVE-2025-66599 Overview
A vulnerability has been identified in Yokogawa Electric Corporation's FAST/TOOLS industrial automation software that allows physical file system paths to be exposed on web pages. This information disclosure vulnerability (CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere) could enable attackers to gather reconnaissance information about the target system's directory structure, potentially facilitating more sophisticated attacks.
Critical Impact
Exposure of internal file system paths through web interfaces could provide attackers with valuable reconnaissance data about the target environment's configuration, aiding in the planning and execution of further attacks against critical industrial control systems.
Affected Products
- FAST/TOOLS Package RVSVRN (R9.01 to R10.04)
- FAST/TOOLS Package UNSVRN (R9.01 to R10.04)
- FAST/TOOLS Package HMIWEB (R9.01 to R10.04)
- FAST/TOOLS Package FTEES (R9.01 to R10.04)
- FAST/TOOLS Package HMIMOB (R9.01 to R10.04)
Discovery Timeline
- 2026-02-09 - CVE-2025-66599 published to NVD
- 2026-02-09 - Last updated in NVD database
Technical Details for CVE-2025-66599
Vulnerability Analysis
This vulnerability falls under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), which occurs when web applications inadvertently reveal internal system information through error messages, debug output, or improperly configured responses. In the case of FAST/TOOLS, the affected packages expose physical file system paths through web page content.
The exposure of physical paths is particularly concerning in industrial control system (ICS) environments where FAST/TOOLS operates. FAST/TOOLS is a SCADA (Supervisory Control and Data Acquisition) software platform used for process monitoring and control in critical infrastructure sectors. Knowledge of the internal directory structure can assist attackers in identifying installation locations, configuration file paths, and potential targets for path traversal or file inclusion attacks.
Root Cause
The vulnerability stems from improper handling of system path information in the web interface components of FAST/TOOLS. The affected packages (RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB) fail to sanitize or mask physical file system paths before rendering them on web pages. This information exposure occurs during normal web operations rather than requiring special error conditions to trigger.
Attack Vector
The attack vector is network-based, requiring no authentication or user interaction to exploit. An attacker with network access to the FAST/TOOLS web interface can observe the exposed physical paths through normal browsing or by inspecting page source code. This reconnaissance information can then be leveraged to:
- Map the installation structure of the FAST/TOOLS deployment
- Identify potential targets for path traversal attacks
- Determine operating system and installation conventions
- Plan more targeted attacks against configuration files or sensitive directories
The vulnerability can be exploited by making standard HTTP requests to the affected web components and analyzing the responses for physical path information embedded in the HTML content or error messages.
Detection Methods for CVE-2025-66599
Indicators of Compromise
- Unusual scanning activity targeting FAST/TOOLS web interfaces from external or unauthorized IP addresses
- HTTP request logs showing systematic enumeration of web pages in the affected packages
- Network traffic analysis revealing repeated access patterns to HMIWEB, HMIMOB, or other affected components
- Web application firewall logs indicating path-related reconnaissance attempts
Detection Strategies
- Implement network monitoring to detect unauthorized access attempts to FAST/TOOLS web interfaces
- Configure web application firewalls to log and alert on suspicious request patterns targeting industrial control system web components
- Deploy intrusion detection signatures that identify reconnaissance activities against Yokogawa products
- Review access logs for the affected packages (RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) for anomalous patterns
Monitoring Recommendations
- Enable detailed logging on all FAST/TOOLS web interface components
- Monitor network traffic to and from FAST/TOOLS servers for unusual access patterns
- Implement alerting for access attempts from untrusted network segments
- Conduct periodic reviews of web server logs for evidence of information gathering activities
How to Mitigate CVE-2025-66599
Immediate Actions Required
- Review the Yokogawa Security Advisory YSAR-26-0001 for official guidance and patch information
- Restrict network access to FAST/TOOLS web interfaces to authorized personnel and systems only
- Implement network segmentation to isolate industrial control systems from general network access
- Deploy web application firewalls in front of FAST/TOOLS web components to filter potentially malicious requests
Patch Information
Yokogawa Electric Corporation has released a security advisory addressing this vulnerability. Organizations running affected versions of FAST/TOOLS (R9.01 to R10.04) should consult the Yokogawa Security Advisory YSAR-26-0001 for specific remediation steps, patch availability, and upgrade instructions. Contact Yokogawa support for assistance with obtaining and applying the appropriate security updates for your environment.
Workarounds
- Implement strict network access controls limiting connectivity to FAST/TOOLS web interfaces to authorized IP addresses only
- Place FAST/TOOLS servers behind a reverse proxy that can filter or mask sensitive path information in responses
- Disable unnecessary web interface features if they are not required for operations
- Implement additional authentication mechanisms at the network layer (VPN, jump servers) for accessing FAST/TOOLS components
# Example: Restrict access to FAST/TOOLS web interface using iptables
# Allow only authorized management network
iptables -A INPUT -p tcp --dport 80 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
