CVE-2025-66602
Yokogawa Fast\/Tools r9.01 – r10.04
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-66602 is a medium-severity Reliance on IP Address for Authentication (CWE-291) vulnerability in Yokogawa Fast\/Tools. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Trusted Relationship (T1199); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-8 (Identification and Authentication (Non-organizational Users)) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-66602 is a critical vulnerability in the FAST/TOOLS software provided by Yokogawa Electric Corporation, specifically affecting its web server component that accepts access by IP address. This flaw makes systems discoverable and exploitable by worms or scanners that randomly probe IP addresses across networks. The vulnerability impacts FAST/TOOLS packages including RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB in versions from R9.01 to R10.04. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-291.
The attack scenario involves remote attackers with network access, including automated worms that perform random IP address searches, requiring no privileges, authentication, or user interaction. Successful exploitation can result in high-impact compromise, granting attackers full confidentiality, integrity, and availability control over the affected system.
Yokogawa has published security advisory YSAR-26-0001-E, available at https://web-material3.yokogawa.com/1/39206/files/YSAR-26-0001-E.pdf, which provides details on mitigation and patching recommendations for this vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207171
Vulnerability Data
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts access by IP address. When a worm that randomly searches for IP addresses intrudes into the network, it could potentially be attacked by the…
more
worm. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires unique identification and authentication of users rather than permitting unauthenticated or spoofable attributes such as source IP.
Requires unique identification and authentication of non-organizational users, precluding reliance on IP address alone.
Mandates documented usage restrictions and configuration requirements for remote access that cannot be satisfied by IP-based authentication.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Strong authentication mechanisms directly replace reliance on spoofable IP addresses.
Managed identities and credentials supplant weak IP-based authentication decisions.
Network monitoring can detect misuse of IP authentication but does not prevent the weakness.
Authorization policies and least privilege reduce dependence on network-location assertions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure-authentication control directly addresses the weakness by requiring proper credentials instead of IP address.
Access-control policy can mandate stronger authentication than IP address alone.
Identity-management processes should replace IP-based identification with verified identities.
Authentication-information rules discourage reliance on mutable attributes such as IP addresses.
Access-rights assignment should be tied to authenticated identities, not network location.
Privileged-access rules require authenticated users rather than implicit IP trust.