CVE-2025-66600: FAST/TOOLS Information Disclosure Flaw

CVE-2025-66600 Overview

A vulnerability has been identified in Yokogawa Electric Corporation's FAST/TOOLS industrial automation software that lacks HTTP Strict Transport Security (HSTS) configuration. This security misconfiguration allows attackers to perform Man-in-the-Middle (MITM) attacks, potentially enabling them to intercept and sniff communications with the web server. The vulnerability affects critical industrial control system (ICS) packages used in operational technology environments.

Critical Impact

Missing HSTS configuration in FAST/TOOLS allows attackers to intercept communications between users and the web server through Man-in-the-Middle attacks, potentially exposing sensitive industrial control data.

Affected Products

• FAST/TOOLS RVSVRN package R9.01 to R10.04
• FAST/TOOLS UNSVRN package R9.01 to R10.04
• FAST/TOOLS HMIWEB package R9.01 to R10.04
• FAST/TOOLS FTEES package R9.01 to R10.04
• FAST/TOOLS HMIMOB package R9.01 to R10.04

Discovery Timeline

• 2026-02-09 - CVE-2025-66600 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2025-66600

Vulnerability Analysis

This vulnerability (CWE-358: Improperly Implemented Security Check for Standard) stems from the FAST/TOOLS web server failing to implement HTTP Strict Transport Security (HSTS) headers. HSTS is a critical web security mechanism that instructs browsers to only communicate with the server over HTTPS connections, preventing protocol downgrade attacks and cookie hijacking.

Without HSTS enabled, an attacker positioned on the network path between a user and the FAST/TOOLS web server can intercept HTTP requests and potentially downgrade HTTPS connections to unencrypted HTTP. This is particularly concerning in industrial control system environments where FAST/TOOLS is deployed, as intercepted communications could reveal sensitive operational data, authentication credentials, or control commands.

The network-based attack vector requires no authentication or user interaction, making it relatively straightforward to exploit in environments where network segmentation is insufficient.

Root Cause

The root cause of this vulnerability is the absence of HSTS header configuration in the FAST/TOOLS web server. When the Strict-Transport-Security header is not sent in HTTP responses, browsers do not enforce HTTPS-only connections. This allows attackers to exploit the initial HTTP request or use techniques like SSL stripping to intercept communications that should be encrypted.

Attack Vector

The attack leverages the lack of HSTS enforcement to perform Man-in-the-Middle attacks. An attacker with network positioning (such as on the same local network segment or through ARP spoofing) can intercept traffic between users and the FAST/TOOLS web server.

The attack flow typically involves:

1. The attacker positions themselves on the network path between the victim and the FAST/TOOLS server
2. When the victim attempts to connect, the attacker intercepts the initial request
3. Without HSTS protection, the attacker can downgrade the connection to HTTP or present fraudulent certificates
4. All communications pass through the attacker, allowing them to capture sensitive data including credentials and control commands

For detailed technical information, refer to the Yokogawa Security Advisory YSAR-26-0001.

Detection Methods for CVE-2025-66600

Indicators of Compromise

• HTTP traffic (port 80) to FAST/TOOLS servers where HTTPS should be exclusively used
• Missing Strict-Transport-Security header in server responses
• Unusual network traffic patterns or ARP anomalies suggesting MITM positioning
• Certificate warnings or mismatches reported by users accessing FAST/TOOLS

Detection Strategies

• Implement network traffic analysis to detect unencrypted HTTP communications with FAST/TOOLS servers
• Deploy intrusion detection systems (IDS) to identify ARP spoofing or suspicious network traffic patterns
• Perform regular security scans to verify HSTS header presence in web server responses
• Monitor for SSL/TLS certificate anomalies that could indicate interception attempts

Monitoring Recommendations

• Enable logging on network devices to capture connection attempts to FAST/TOOLS web interfaces
• Configure alerts for any HTTP (non-HTTPS) traffic to ICS web servers
• Implement network segmentation monitoring to detect unauthorized access to OT network segments
• Deploy endpoint detection solutions to identify potential MITM attack tools on the network

How to Mitigate CVE-2025-66600

Immediate Actions Required

• Apply the vendor-provided patch or configuration update to enable HSTS on affected FAST/TOOLS installations
• Implement network segmentation to isolate FAST/TOOLS servers from untrusted network segments
• Configure firewalls to block HTTP (port 80) access to FAST/TOOLS web interfaces, allowing only HTTPS
• Review and strengthen network access controls for ICS environments

Patch Information

Yokogawa Electric Corporation has released security guidance for this vulnerability. Organizations should consult the Yokogawa Security Advisory YSAR-26-0001 for specific remediation instructions and patch availability for affected FAST/TOOLS versions R9.01 through R10.04.

Workarounds

• Deploy a reverse proxy with HSTS enabled in front of the FAST/TOOLS web server
• Implement strict network access controls to limit who can access the FAST/TOOLS web interface
• Use VPN connections for all remote access to FAST/TOOLS systems
• Configure client browsers to always use HTTPS for FAST/TOOLS server addresses via browser policies or HSTS preload lists

# Example: Configure a reverse proxy (nginx) with HSTS for FAST/TOOLS
# Add to nginx server configuration block
server {
    listen 443 ssl;
    server_name fasttools.example.com;
    
    # Enable HSTS with 1-year max-age
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    
    # Redirect all HTTP to HTTPS
    if ($scheme = http) {
        return 301 https://$server_name$request_uri;
    }
    
    # Proxy to FAST/TOOLS backend
    location / {
        proxy_pass https://internal-fasttools-server;
    }
}