CVE Intelligence
Analysis AI-assisted

CVE-2025-66603: Yokogawa FAST/TOOLS Web Server Accepts HTTP OPTIONS Method

CVE-2025-66603 affects the web server of Yokogawa FAST/TOOLS, which accepts the HTTP OPTIONS method. According to the record, an attacker could potentially use this information to support other attacks. NVD rates it 9.8 (critical) under CVSS 3.1, and no fixed version is listed in the record.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-66603 is a weakness in FAST/TOOLS from Yokogawa Electric Corporation. The record states that the web server accepts the OPTIONS HTTP method, and that an attacker could potentially use the resulting information to carry out other attacks. The record classifies the issue as CWE-358, improperly implemented security check.

Impact

  • The CVSS 3.1 vector in the record is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network reachability without privileges or user interaction, with high impact on confidentiality, integrity and availability.
  • The direct effect described in the record is information exposure that could support further attacks.
  • The CNA-provided CVSS 4.0 score in the record is 2.1.

Affected products and versions

  • Yokogawa FAST/TOOLS, packages RVSVRN, UNSVRN, HMIWEB, FTEES and HMIMOB, versions R9.01 to R10.04 as stated in the vendor advisory YSAR-26-0001-E.
  • The record lists no fixed version.

Exploitation status

The record shows that this CVE is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted. The EPSS probability in the record is 0.00303 with a percentile of 0.213.

Remediation and mitigation

  • Check the vendor advisory for the vendor's guidance and any updates for affected packages.
  • Inventory FAST/TOOLS installations within the R9.01 to R10.04 range and confirm whether the web server component is reachable from untrusted networks.
  • Limit network exposure of the web interface, and disable HTTP methods that are not required by operations, following the vendor's instructions.

Detection guidance

  • Review web server access logs for unusual or unexpected HTTP methods directed at FAST/TOOLS interfaces.
  • Correlate such events with network segmentation records to identify sources outside the expected operational zones.

Limitations of the available information

  • The record does not identify a fixed version, so remediation status is unknown from the data provided.
  • The record does not describe the exact conditions under which the OPTIONS behavior leads to a practical attack.
  • The record's EPSS date is listed as 2026-10-13, which should be verified against the live source.

Frequently asked questions

What is CVE-2025-66603?

It is a weakness in Yokogawa FAST/TOOLS where the web server accepts the HTTP OPTIONS method, which the record says could help an attacker carry out other attacks.

Which versions are affected?

The record lists FAST/TOOLS packages RVSVRN, UNSVRN, HMIWEB, FTEES and HMIMOB in versions R9.01 to R10.04. Check the vendor advisory for details.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.