Description
In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.
Published: 2026-06-18
Score: 8.4 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

* Users are discouraged from using documents from unknown/untrusted sources. * Users are encouraged to store .ctl files in a folder only writeable by admin-level users. * Users are encouraged to operate in “Safe Mode” when loading documents that have been out of their control. * Users are encouraged to apply a document editing password to their documents.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 18 Jun 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 18 Jun 2026 18:45:00 +0000

Type Values Removed Values Added
Description In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.
Title Access of resource using incompatible type ('type confusion') in AzeoTech DAQFactory
Weaknesses CWE-843
References
Metrics cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2026-06-18T18:42:13.934Z

Reserved: 2026-06-16T12:13:25.809Z

Link: CVE-2026-12390

cve-icon Vulnrichment

Updated: 2026-06-18T18:42:09.712Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')