CVE Intelligence
Analysis AI-assisted

CVE-2025-66606: Yokogawa FAST/TOOLS Improper URL Encoding (CWE-86)

A vulnerability in Yokogawa FAST/TOOLS involves improper encoding of URLs, classified as CWE-86. The record states that an attacker could tamper with web pages or execute malicious scripts, and NVD scores it 9.6 (critical) under CVSS v3.1. No fixed version is listed in the record, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A vulnerability in Yokogawa FAST/TOOLS relates to improper encoding of URLs (CWE-86). According to the CVE record, an attacker could tamper with web pages or execute malicious scripts.

Impact

  • The record states that successful exploitation could allow web page tampering and execution of malicious scripts.
  • NVD rates the issue 9.6 (critical) under CVSS v3.1, with network attack vector, low complexity, no privileges required, user interaction required, scope changed, and high impact to confidentiality, integrity and availability.
  • The CNA also provides a CVSS v4.0 score of 2.1 in the record.

Affected products and versions

  • Yokogawa FAST/TOOLS, packages RVSVRN, UNSVRN, HMIWEB, FTEES and HMIMOB.
  • The record lists versions from R9.01 to R10.04.

Exploitation status

  • This CVE is not listed in the CISA KEV catalog in the record.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • The record contains no fixed version. Review the vendor advisory YSAR-26-0001-E for the vendor's guidance.
  • Inventory FAST/TOOLS deployments and confirm the installed package versions against the listed range.
  • Limit access to FAST/TOOLS web interfaces to trusted networks and authorized users.
  • Review web content integrity controls and monitor for unexpected changes to served pages.

Detection guidance

  • Monitor web server and application logs for unusual or malformed URL requests directed at FAST/TOOLS components.
  • Alert on unexpected changes to web content or unexplained script behavior in operator-facing interfaces.

Limitations of the available information

  • The record does not provide a fixed version, a patch identifier or a remediation timeline.
  • The record does not describe the exact URL conditions or request structure that trigger the flaw, and this analysis does not provide them.
  • The CVSS v4.0 score is from the CNA, while the critical rating is from NVD under CVSS v3.1.
  • The EPSS value is provided in the record but its interpretation depends on context.

Frequently asked questions

What is the core weakness in CVE-2025-66606?

The record describes improper encoding of URLs in Yokogawa FAST/TOOLS, mapped to CWE-86. According to the record, this could allow an attacker to tamper with web pages or execute malicious scripts.

Which FAST/TOOLS versions are listed as affected?

The record lists the range R9.01 to R10.04 for the packages RVSVRN, UNSVRN, HMIWEB, FTEES and HMIMOB.

Is a fix available?

The record does not list a fixed version. Check the vendor advisory YSAR-26-0001-E for the vendor's current guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.