AzeoTech DAQFactory Out-of-Bounds Write Vulnerability Leading to Arbitrary Code Execution

A memory corruption vulnerability allowing out-of-bounds write has been identified in AzeoTech DAQFactory version 20.7 (Build 2555) and prior. This vulnerability can be exploited by an attacker to write data beyond the allocated memory buffer, potentially leading to arbitrary code execution or causing the application to crash. Exploitation requires uploading a malicious .ctl file.

Impact

Exploitation of this vulnerability could result in arbitrary code execution or a system crash.

Remediation

AzeoTech has released an update to address this vulnerability in DAQFactory version 21.1. Users are also advised to store .ctl files in a folder only writable by admin-level users, operate in 'Safe Mode' when handling documents that have been out of their control, and apply a document editing password to their files.