AzeoTech DAQFactory versions 21.1 and earlier contain a use‑after‑free flaw that can be triggered by parsing specially crafted .ctl files. This exploitable weakness – identified as CWE‑416 – allows an attacker to execute arbitrary code within the context of DAQFactory, potentially taking full control of the affected system. The primary impact is the loss of confidentiality, integrity, and availability of the device and the data it processes.

The vulnerability affects AzeoTech DAQFactory product lines. Clients running version 21.1 or any earlier release are vulnerable; newer releases are not impacted as documented by the CNA.

The vulnerability is rated with a CVSS score of 8.4, indicating high severity. EPSS data is not available, so the exact exploitation probability cannot be quantified, but the lack of KEV listing suggests no confirmed exploitation yet. The likely attack vector involves delivering a malicious .ctl file—either locally or through an untrusted network channel—leading to code execution at the user’s privilege level.