CVE-2025-66603
Published: 09 February 2026
Summary
CVE-2025-66603 is a critical-severity Improperly Implemented Security Check for Standard (CWE-358) vulnerability in Yokogawa Fast\/Tools. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and CM-7 (Least Functionality).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly protects public-facing web servers from attacker reconnaissance techniques like HTTP OPTIONS requests that disclose supported methods.
Enforces secure configuration settings on the web server to disable or restrict HTTP OPTIONS method support, preventing information disclosure.
Limits web server functionality to only essential capabilities, prohibiting unnecessary HTTP methods like OPTIONS used for reconnaissance.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability allows remote unauthenticated exploitation of a public-facing web server via OPTIONS method for information disclosure that facilitates further attacks.
NVD Description
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts the OPTIONS method. An attacker could potentially use this information to carry out other attacks. The affected products and versions are as follows: FAST/TOOLS…
more
(Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
Deeper analysisAI
CVE-2025-66603 is a vulnerability in FAST/TOOLS software provided by Yokogawa Electric Corporation, where the web server accepts the OPTIONS HTTP method. An attacker could potentially use this information to carry out other attacks. The vulnerability affects FAST/TOOLS packages RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB in versions R9.01 to R10.04 and is associated with CWE-358. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A remote, unauthenticated attacker with network access to the affected web server can exploit this vulnerability with low complexity and no user interaction. By sending an OPTIONS request, the attacker can obtain information about the server, such as supported HTTP methods, which could facilitate further attacks leading to high impacts on confidentiality, integrity, and availability.
Yokogawa has issued security advisory YSAR-26-0001-E, available at https://web-material3.yokogawa.com/1/39206/files/YSAR-26-0001-E.pdf, which provides details on the vulnerability and associated mitigation measures.
Details
- CWE(s)