Cyber Resilience

CVE-2025-66601

Yokogawa Fast\/Tools r9.01 – r10.04

Published
09 February 2026
Modified
05 March 2026
Patch / advisory
CVSS Score v4 6.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0015 5th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-66601 is a medium-severity Improperly Implemented Security Check for Standard (CWE-358) vulnerability in Yokogawa Fast\/Tools. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SI-15 (Information Output Filtering) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not specify MIME types. When an attacker performs a content sniffing attack, malicious scripts could be executed. The affected products and versions are as follows:…

more

FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Missing MIME type specification enables content sniffing leading to malicious script execution in the web/HMI interface, directly facilitating exploitation of the public-facing application.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-66607Same product: Yokogawa Fast\/Tools
CVE-2025-66603Same product: Yokogawa Fast\/Tools
CVE-2025-66604Same product: Yokogawa Fast\/Tools
CVE-2025-66602Same product: Yokogawa Fast\/Tools
CVE-2025-66606Same product: Yokogawa Fast\/Tools
CVE-2025-66608Same product: Yokogawa Fast\/Tools
CVE-2025-66605Same product: Yokogawa Fast\/Tools
CVE-2025-66594Same product: Yokogawa Fast\/Tools
CVE-2025-66596Same product: Yokogawa Fast\/Tools
CVE-2025-66598Same product: Yokogawa Fast\/Tools

Affected Assets

yokogawa
fast\/tools
r9.01 — r10.04

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-15 Information Output Filtering
  • CM-6 Configuration Settings
  • AC-4 Information Flow Enforcement
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V17.2.8

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces filtering and proper typing of server-generated web responses so browsers cannot misinterpret untyped content as executable scripts.

prevent

Requires explicit configuration settings that mandate correct MIME-type headers (and X-Content-Type-Options) on all FAST/TOOLS web responses.

prevent

Can enforce information-flow rules that only permit responses carrying validated, non-executable content types from the affected HMIWEB/FTEES components.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require correct implementation of standardized security checks and algorithms.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development and acceptance validates that required security checks function as specified.

prevents

Use of cryptography control depends on correct implementation of standardized cryptographic checks.

prevents

Secure development life cycle mandates verification that security checks required by standards are correctly implemented.

prevents

Application security requirements explicitly call for correct implementation of standardized security mechanisms.

prevents

Secure system architecture and engineering principles require faithful realization of protocol-level security checks.

prevents

Secure coding practices directly address correct implementation of security-relevant checks in standardized algorithms.

References