CVE-2025-66604: FAST/TOOLS Information Disclosure Issue

CVE-2025-66604 Overview

A vulnerability has been identified in Yokogawa Electric Corporation's FAST/TOOLS industrial automation software. The vulnerability allows library version information to be displayed on web pages, which could be leveraged by attackers for reconnaissance purposes and to facilitate further targeted attacks against the system.

This information disclosure vulnerability (CWE-319: Cleartext Transmission of Sensitive Information) exposes software version details that attackers can use to identify known vulnerabilities in specific versions, plan targeted exploitation strategies, and conduct more effective attacks against industrial control system environments.

Critical Impact

Exposed version information enables attackers to fingerprint the exact software deployment, potentially leading to targeted exploitation of known vulnerabilities in FAST/TOOLS industrial control systems.

Affected Products

• FAST/TOOLS Package RVSVRN R9.01 to R10.04
• FAST/TOOLS Package UNSVRN R9.01 to R10.04
• FAST/TOOLS Package HMIWEB R9.01 to R10.04
• FAST/TOOLS Package FTEES R9.01 to R10.04
• FAST/TOOLS Package HMIMOB R9.01 to R10.04

Discovery Timeline

• 2026-02-09 - CVE CVE-2025-66604 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2025-66604

Vulnerability Analysis

This vulnerability exists in the web interface component of Yokogawa FAST/TOOLS, an industrial automation platform commonly deployed in SCADA and process control environments. The flaw allows library version information to be inadvertently exposed through web pages served by the application.

The information disclosure occurs when version details of underlying libraries are rendered on web pages accessible to users. While this may seem benign, in industrial control system (ICS) environments, such information provides significant value to attackers during reconnaissance phases. Knowing the exact software versions allows threat actors to cross-reference known vulnerabilities, select appropriate exploits, and craft targeted attacks.

The network-based attack vector requires user interaction, and the complexity of successful exploitation is higher due to preconditions that must be met. However, in ICS environments where software updates are often delayed due to operational constraints, version disclosure can have amplified impact.

Root Cause

The root cause of this vulnerability stems from improper handling of sensitive version information in the web interface components. The application fails to adequately suppress or sanitize library version details before rendering them on web pages, violating the principle of minimal information disclosure. This is classified under CWE-319 (Cleartext Transmission of Sensitive Information), indicating that sensitive data is being transmitted without proper protection mechanisms.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker with network access to the FAST/TOOLS web interface can observe version information displayed on web pages. This information gathering does not require authentication but does require user interaction to access the vulnerable pages. The attack flow involves:

1. Attacker gains network access to the FAST/TOOLS web interface
2. Vulnerable web pages are accessed, revealing library version information
3. Attacker correlates version information with known vulnerability databases
4. Gathered intelligence is used to plan and execute targeted attacks

The vulnerability itself does not directly compromise confidentiality of operational data, integrity, or availability, but serves as a stepping stone for more sophisticated attacks against the industrial control environment.

Detection Methods for CVE-2025-66604

Indicators of Compromise

• Unusual HTTP requests targeting web interface pages that display version information
• Reconnaissance scanning patterns against FAST/TOOLS web servers
• Increased traffic to specific web endpoints from unknown or suspicious IP addresses

Detection Strategies

• Monitor web server access logs for repeated requests to pages known to display version information
• Implement web application firewall (WAF) rules to detect and alert on version fingerprinting attempts
• Deploy network monitoring to identify scanning activity targeting industrial control system web interfaces

Monitoring Recommendations

• Enable verbose logging on FAST/TOOLS web interface components
• Configure SIEM rules to correlate web access patterns indicative of reconnaissance activity
• Implement network segmentation monitoring to detect unauthorized access attempts to ICS network zones

How to Mitigate CVE-2025-66604

Immediate Actions Required

• Review Yokogawa Security Advisory YSAR-26-0001 for vendor-specific guidance and patches
• Restrict network access to FAST/TOOLS web interfaces to authorized personnel and networks only
• Implement network segmentation to isolate ICS components from general corporate networks
• Enable access logging and monitoring for all web interface access

Patch Information

Yokogawa Electric Corporation has published security advisory YSAR-26-0001 addressing this vulnerability. Organizations should review this advisory for specific patch information and remediation guidance applicable to their FAST/TOOLS deployment.

Contact Yokogawa support for obtaining patches for affected versions R9.01 through R10.04 across the RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB packages.

Workarounds

• Implement reverse proxy or WAF rules to strip or mask version information from HTTP responses
• Restrict access to the FAST/TOOLS web interface using IP whitelisting and VPN requirements
• Deploy network-level access controls to limit exposure of ICS web interfaces to trusted networks only
• Consider disabling unnecessary web interface features until patches can be applied

# Example: Restrict access to FAST/TOOLS web interface using firewall rules
# Allow only trusted management network (example: 10.10.50.0/24)
iptables -A INPUT -p tcp --dport 80 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP