CVE Intelligence
Analysis AI-assisted

CVE-2025-66602: Yokogawa FAST/TOOLS Web Server IP Address Reliance Weakness

A vulnerability was found in Yokogawa FAST/TOOLS, affecting versions R9.01 to R10.04, in which the web server accepts access based on IP address. The record maps the weakness to CWE-291 and notes that a worm scanning randomly for IP addresses could potentially attack affected systems after entering a network. NVD assigns a CVSS 3.1 base score of 9.8, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-66602 affects FAST/TOOLS from Yokogawa Electric Corporation. According to the record, the product's web server accepts access by IP address, and a worm that randomly searches for IP addresses could potentially reach and attack systems once inside the network. The vendor advisory YSAR-26-0001-E is referenced, and the CVE is also listed in the NVD entry.

Impact

  • The record describes a potential exposure to worm-based attacks that target IP addresses inside the network.
  • NVD scores the issue 9.8 under CVSS 3.1, which corresponds to critical severity in the record.
  • The CNA-provided CVSS 4.0 score in the record is 6.9.
  • The record links the weakness to CWE-291, which concerns reliance on IP addresses. Its formal name is not included in the record.

Affected products and versions

  • Product: FAST/TOOLS by Yokogawa Electric Corporation.
  • Versions: R9.01 to R10.04.
  • Packages listed in the description: RVSVRN, UNSVRN, HMIWEB, FTEES and HMIMOB.

Exploitation status

The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog according to the record. No confirmed exploitation appears in the sources consulted. The EPSS probability in the record is 0.0035 (percentile 0.26828).

Remediation and mitigation

  • The record contains no fixed version. The absence of a listed fix does not mean none exists, so the vendor advisory should be checked for current guidance.
  • Until guidance is confirmed, limit network reachability of the FAST/TOOLS web interface to trusted management segments.
  • Reduce the exposure of IP-addressed services from untrusted networks and keep network segmentation between operational and general IT environments.

Detection guidance

  • Monitor logs and network traffic for unexpected connections to the FAST/TOOLS web server, especially from unknown or unauthorized IP addresses.
  • Watch for broad scanning activity across internal address ranges, which may indicate worm-like behavior.
  • Review access records to confirm that only authorized hosts reach the web interface.

Limitations of the available information

The record does not provide a fixed version, a vendor-specific technical description beyond the summary, public exploit information, or the formal CWE name. Exploitation details, attack prerequisites and patch availability beyond the referenced advisory are unknown from the data available.

Frequently asked questions

What is the core weakness in CVE-2025-66602?

According to the record, the FAST/TOOLS web server accepts access based on IP address. The record links this to CWE-291.

Which versions are affected?

The record lists FAST/TOOLS from R9.01 to R10.04, including the packages RVSVRN, UNSVRN, HMIWEB, FTEES and HMIMOB.

Is this vulnerability known to be actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.