CVE-2025-66608: Yokogawa FAST/TOOLS Path Traversal Flaw

CVE-2025-66608 Overview

A path traversal vulnerability has been discovered in FAST/TOOLS, an industrial automation software suite provided by Yokogawa Electric Corporation. The vulnerability exists due to improper URL validation, which allows unauthenticated attackers to send specially crafted requests to steal files from the web server. This flaw affects critical industrial control system (ICS) components used in operational technology (OT) environments.

Critical Impact

Unauthenticated remote attackers can exploit improper URL validation to traverse directories and exfiltrate sensitive files from FAST/TOOLS web servers, potentially exposing industrial control system configurations and operational data.

Affected Products

• FAST/TOOLS Package: RVSVRN (Versions R9.01 to R10.04)
• FAST/TOOLS Package: UNSVRN (Versions R9.01 to R10.04)
• FAST/TOOLS Package: HMIWEB (Versions R9.01 to R10.04)
• FAST/TOOLS Package: FTEES (Versions R9.01 to R10.04)
• FAST/TOOLS Package: HMIMOB (Versions R9.01 to R10.04)

Discovery Timeline

• 2026-02-09 - CVE-2025-66608 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2025-66608

Vulnerability Analysis

This vulnerability is classified under CWE-29 (Path Traversal: '..\filename'), indicating that the FAST/TOOLS web server fails to properly sanitize URL paths containing directory traversal sequences. The flaw enables attackers to break out of the intended web root directory and access arbitrary files on the underlying server.

The vulnerability is particularly concerning given that FAST/TOOLS is deployed in industrial environments where it serves as a SCADA (Supervisory Control and Data Acquisition) platform. Successful exploitation could allow attackers to access configuration files, credentials, process data, or other sensitive information stored on the web server hosting the FAST/TOOLS application.

Root Cause

The root cause of CVE-2025-66608 lies in insufficient input validation of URL parameters processed by the FAST/TOOLS web server components. When handling HTTP requests, the application does not adequately filter or neutralize path traversal sequences such as ../ or ..\, allowing attackers to navigate outside the designated web directory structure.

This improper validation affects multiple FAST/TOOLS packages including RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB, suggesting the vulnerable URL parsing logic is shared across these components.

Attack Vector

The attack is network-based and requires no authentication or user interaction, making it highly accessible to remote attackers. An adversary can exploit this vulnerability by crafting malicious HTTP requests containing path traversal sequences in the URL.

The attack flow involves:

1. The attacker identifies a FAST/TOOLS web server accessible over the network
2. Specially crafted HTTP requests containing directory traversal sequences (e.g., ../../etc/passwd or ..\..\..\windows\system.ini) are sent to the server
3. The vulnerable URL parsing logic processes the malicious path without proper sanitization
4. Files outside the web root directory are returned to the attacker, leading to information disclosure

For technical details on this vulnerability, refer to the Yokogawa Security Advisory YSAR-26-0001-E.

Detection Methods for CVE-2025-66608

Indicators of Compromise

• HTTP access logs containing URL patterns with ../, ..\, or encoded variants (%2e%2e%2f, %2e%2e/)
• Unusual file access patterns in web server logs referencing system files or directories outside the web root
• Network traffic containing path traversal sequences targeting FAST/TOOLS web server ports
• Unexpected outbound data transfers from FAST/TOOLS servers containing configuration or system file contents

Detection Strategies

• Deploy web application firewalls (WAF) configured to detect and block path traversal attack patterns
• Implement intrusion detection system (IDS) signatures to identify HTTP requests containing directory traversal sequences
• Monitor FAST/TOOLS web server access logs for requests containing ../, ..\, or URL-encoded equivalents
• Configure SIEM rules to alert on multiple failed or suspicious file access attempts from external sources

Monitoring Recommendations

• Enable detailed logging on FAST/TOOLS web server components and forward logs to a centralized security monitoring platform
• Implement network segmentation monitoring to detect unauthorized access attempts to ICS/SCADA systems
• Establish baseline network behavior for FAST/TOOLS servers and alert on anomalous HTTP request patterns
• Regularly audit file access events on systems hosting FAST/TOOLS to identify unauthorized file reads

How to Mitigate CVE-2025-66608

Immediate Actions Required

• Review the Yokogawa Security Advisory YSAR-26-0001-E for vendor-specific remediation guidance
• Restrict network access to FAST/TOOLS web server components to authorized systems only
• Implement web application firewall rules to block requests containing path traversal patterns
• Conduct a security assessment to determine if the vulnerability has been exploited in your environment

Patch Information

Organizations running affected versions of FAST/TOOLS (R9.01 to R10.04) should immediately consult the Yokogawa Security Advisory YSAR-26-0001-E for official patch information and remediation steps. Contact Yokogawa Electric Corporation support for guidance on upgrading to a patched version of the affected packages (RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB).

Workarounds

• Implement network segmentation to isolate FAST/TOOLS servers from untrusted network segments
• Deploy a reverse proxy with strict URL filtering to sanitize incoming requests before they reach FAST/TOOLS
• Apply firewall rules to restrict access to FAST/TOOLS web interfaces to known, trusted IP addresses
• Consider temporarily disabling affected web components if they are not operationally critical while awaiting patches

# Example: Firewall rule to restrict FAST/TOOLS web access (Linux iptables)
# Replace <TRUSTED_IP> with your management network IP range
# Replace <FASTTOOLS_PORT> with the actual web server port

iptables -A INPUT -p tcp --dport <FASTTOOLS_PORT> -s <TRUSTED_IP> -j ACCEPT
iptables -A INPUT -p tcp --dport <FASTTOOLS_PORT> -j DROP