CVE-2025-66608

High

Published: 09 February 2026

Published

09 February 2026

Modified

06 March 2026

KEV Added

—

Patch

—

CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0039 30.2th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-66608 is a high-severity Path Traversal: '\..\filename' (CWE-29) vulnerability in Yokogawa Fast\/Tools. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-66608 is a vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software, where the product fails to properly validate URLs. This flaw allows an attacker to send specially crafted requests to steal files from the web server. The affected components include FAST/TOOLS packages RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB in versions from R9.01 to R10.04. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-29 (Path Traversal: '.../...').

An unauthenticated attacker with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction. Successful exploitation enables remote file disclosure from the web server, potentially exposing sensitive configuration data, credentials, or other critical files without impacting integrity or availability.

Mitigation details are provided in Yokogawa's security advisory YSAR-26-0001-E, available at https://web-material3.yokogawa.com/1/39206/files/YSAR-26-0001-E.pdf. Security practitioners should consult this document for patching instructions and workarounds applicable to the affected versions.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-207167

Vulnerability details

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate URLs. An attacker could send specially crafted requests to steal files from the web server. The affected products and versions are as…

follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04

CWE(s): CWE-29

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1552.001 Credentials In Files Credential Access

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

attack.mitre.org →

Why these techniques?

Path traversal in public-facing web server directly enables remote file read (T1190), local data collection (T1005), and credential file access (T1552.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0