AzeoTech DAQFactory Memory Corruption Vulnerability in .ctl File Parsing Allowing Code Execution

A memory corruption vulnerability has been identified in AzeoTech DAQFactory release 20.7 (Build 2555) and prior. The issue arises while the application parses specially crafted .ctl files, leading to out-of-bounds write and read vulnerabilities. This memory corruption could allow an attacker to execute arbitrary code in the context of the current process.

Impact

Exploitation of this vulnerability could lead to memory corruption, allowing for arbitrary code execution in the context of the current process.

Remediation

AzeoTech has released an update to address these vulnerabilities in DAQFactory version 21.1. Users are also advised to store .ctl files in a folder only writable by admin-level users, operate in 'Safe Mode' when loading documents that have been out of their control, and apply a document editing password to their documents.