CVE-2025-66601: Yokogawa FAST/TOOLS XSS Vulnerability

CVE-2025-66601 Overview

A vulnerability has been identified in FAST/TOOLS, an industrial automation software suite provided by Yokogawa Electric Corporation. The product fails to properly specify MIME types for served content, creating an attack surface for content sniffing attacks. When exploited, this vulnerability allows attackers to execute malicious scripts by manipulating how browsers interpret the content type of responses.

Content sniffing (also known as MIME sniffing) occurs when a browser attempts to determine the content type of a response by examining the content itself rather than relying on the declared Content-Type header. Without proper MIME type declarations, attackers can craft malicious payloads that browsers misinterpret and execute as executable scripts.

Critical Impact

Successful exploitation could allow attackers to execute malicious scripts in the context of the FAST/TOOLS web interface, potentially compromising industrial control system operations and sensitive SCADA data.

Affected Products

• FAST/TOOLS RVSVRN Package R9.01 to R10.04
• FAST/TOOLS UNSVRN Package R9.01 to R10.04
• FAST/TOOLS HMIWEB Package R9.01 to R10.04
• FAST/TOOLS FTEES Package R9.01 to R10.04
• FAST/TOOLS HMIMOB Package R9.01 to R10.04

Discovery Timeline

• 2026-02-09 - CVE-2025-66601 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2025-66601

Vulnerability Analysis

This vulnerability is classified under CWE-358 (Improperly Implemented Security Check for Standard). The core issue stems from the FAST/TOOLS web components failing to include explicit Content-Type headers with the X-Content-Type-Options: nosniff directive in HTTP responses.

When HTTP responses lack proper MIME type specification, web browsers may engage in content sniffing behavior to determine how to render or process the received data. This behavior can be exploited by attackers who craft specially designed payloads that appear as one content type but are actually executable scripts.

The vulnerability affects multiple FAST/TOOLS packages that provide web-based interfaces for industrial automation and SCADA operations. Given the network-accessible nature of this attack vector, exploitation does not require authentication but may need additional preparation steps to successfully execute malicious scripts.

Root Cause

The root cause of this vulnerability lies in the improper implementation of HTTP response headers within the FAST/TOOLS web interface components. The affected packages (RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB) serve web content without properly declaring MIME types or enforcing the X-Content-Type-Options security header.

This oversight allows browsers to "guess" the content type based on content analysis rather than trusting the declared type, creating an opportunity for script injection through content type confusion.

Attack Vector

The attack leverages the network-accessible web interface provided by FAST/TOOLS. An attacker can exploit this vulnerability by:

1. Crafting malicious content that contains script code but is served without proper MIME type declaration
2. Delivering the malicious content through the FAST/TOOLS web interface
3. Exploiting the browser's content sniffing behavior to have the malicious payload interpreted and executed as script code

The vulnerability enables potential script execution that could lead to unauthorized access to SCADA system data, manipulation of industrial process visualizations, or theft of session credentials from legitimate users accessing the FAST/TOOLS HMI web interface.

While no user interaction is required to trigger the vulnerability at the server level, the attack complexity includes some preparatory requirements to successfully position malicious content for browser execution.

Detection Methods for CVE-2025-66601

Indicators of Compromise

• Unusual HTTP responses from FAST/TOOLS web interfaces lacking proper Content-Type headers
• Browser console errors indicating MIME type mismatches or content sniffing warnings
• Unexpected script execution originating from FAST/TOOLS web components
• Network traffic showing requests with ambiguous or missing content type declarations

Detection Strategies

• Monitor HTTP response headers from FAST/TOOLS servers for missing or improper Content-Type headers
• Implement network intrusion detection rules to identify responses lacking X-Content-Type-Options: nosniff directive
• Review web application firewall logs for attempts to inject content that could trigger MIME sniffing attacks
• Audit FAST/TOOLS server configurations for proper security header implementation

Monitoring Recommendations

• Enable detailed HTTP logging on web servers hosting FAST/TOOLS components to capture response header information
• Deploy SentinelOne Singularity XDR to monitor endpoint behavior for suspicious script execution originating from industrial control system web interfaces
• Implement network traffic analysis to detect anomalous content patterns in FAST/TOOLS communications
• Configure SIEM alerts for authentication anomalies following access to FAST/TOOLS web interfaces

How to Mitigate CVE-2025-66601

Immediate Actions Required

• Review the Yokogawa Security Advisory YSAR-26-0001 for vendor-specific guidance
• Restrict network access to FAST/TOOLS web interfaces to authorized internal networks only
• Implement web application firewalls with content sniffing protection rules
• Consider deploying reverse proxy configurations that enforce proper security headers

Patch Information

Yokogawa Electric Corporation has issued a security advisory (YSAR-26-0001) addressing this vulnerability. Organizations running FAST/TOOLS versions R9.01 through R10.04 should consult the Yokogawa Security Advisory YSAR-26-0001 for specific remediation instructions and available patches.

Contact Yokogawa technical support to obtain the latest security updates for your specific FAST/TOOLS installation and packages.

Workarounds

• Configure a reverse proxy in front of FAST/TOOLS web components to inject proper security headers including X-Content-Type-Options: nosniff
• Implement network segmentation to limit access to FAST/TOOLS web interfaces from untrusted networks
• Enable browser security features and deploy endpoint protection that can detect and block malicious script execution
• Use web application firewalls to filter potentially malicious content targeting MIME sniffing vulnerabilities

# Example nginx reverse proxy configuration to add security headers
# Place in front of FAST/TOOLS web interface
location /fasttools/ {
    proxy_pass http://fasttools-internal:8080/;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Content-Security-Policy "default-src 'self'" always;
}