AzeoTech DAQFactory Out-of-Bounds Read Vulnerability Allowing Information Disclosure or System Crash

AzeoTech DAQFactory versions through 20.7 (Build 2555) contain an out-of-bounds read vulnerability. This issue can be exploited to read data beyond the allocated buffer, potentially leading to information disclosure or causing the application to crash.

Impact

Exploitation of this vulnerability could result in unauthorized information disclosure or a system crash.

Remediation

AzeoTech has released DAQFactory version 21.1 to address this vulnerability. Users are also advised to avoid using documents from untrusted sources, store .ctl files in admin-only writable folders, operate in 'Safe Mode' with uncontrolled documents, and apply document editing passwords. CISA recommends minimizing network exposure for control system devices, using firewalls, and when remote access is necessary, employing secure methods like VPNs.