Type Confusion in AzeoTech DAQFactory .ctl File Handling

Successful exploitation can result in arbitrary code execution on the affected system, with confidentiality, integrity, and availability impacts rated high in the cited CVSS assessments. Because exploitation occurs through malicious project/control file handling, an attacker could execute code in the security context of the user running DAQFactory, potentially enabling full compromise of the workstation or engineering system hosting the software.

Do not open untrusted or unsolicited .ctl files. Restrict the ability to transfer such files into engineering environments, and validate file provenance before use. As additional ICS-focused defensive measures, minimize network exposure of control system devices, place control system networks behind firewalls and isolate them from business networks, and use secure remote access methods such as fully updated VPN solutions where remote connectivity is required. Perform impact analysis and risk assessment before deploying mitigations in operational environments.

Upgrade AzeoTech DAQFactory to a version later than 21.1 and apply the vendor's patch or fixed release when available. Organizations should prioritize updating systems that handle untrusted or externally supplied .ctl files.