CVE-2026-12390: AzeoTech DAQFactory Type Confusion Code Execution Vulnerability

Technical summary

CVE-2026-12390 is a Type Confusion vulnerability (CWE-843) in AzeoTech DAQFactory that permits remote code execution via specially crafted .ctl files. The flaw resides in the application's file parsing logic, where insufficient type validation allows an attacker to manipulate object instantiation or method invocation during deserialization or processing of control files. When an unprivileged user opens a malicious .ctl file, the type confusion condition enables execution of arbitrary code in the context of the running DAQFactory process. The vulnerability has a CVSS 3.1 score of 7.8 (HIGH), with an attack vector of Local, Attack Complexity Low, no Privilege Requirement, and User Interaction required.

Business impact

This vulnerability poses a significant risk to organizations using DAQFactory for industrial control, data acquisition, or automation tasks. An attacker who tricks or socially engineers a DAQFactory user into opening a malicious .ctl file can gain full code execution on the target system. This could lead to unauthorized access to sensitive operational data, manipulation of control parameters, lateral movement into connected industrial networks, or deployment of persistent malware. For organizations in manufacturing, utilities, or critical infrastructure relying on DAQFactory, compromise of these systems can disrupt operations, cause safety incidents, or expose intellectual property.

Affected systems

AzeoTech DAQFactory versions 21.1 and prior are affected. Organizations should inventory all DAQFactory deployments and version numbers to determine exposure. This includes both standalone instances and deployments integrated into larger industrial control or data acquisition frameworks. DAQFactory is commonly used in research, manufacturing, and engineering environments where real-time data collection and system control are critical.

Exploitability

Exploitation requires user interaction—an attacker must convince a DAQFactory user to open a crafted .ctl file. No authentication or elevated privileges are required on the target system. The attack surface includes email delivery of malicious files, compromised file repositories, or supply-chain scenarios where .ctl files are exchanged. While the barrier to exploitation is not trivial (social engineering required), the payoff is full code execution, making this a credible and practical attack vector.

Remediation

Update AzeoTech DAQFactory to a patched version that addresses the type confusion flaw. Verify the exact patched version number and availability in the AzeoTech vendor advisory. Additionally, implement file validation procedures to restrict .ctl file execution to trusted sources, enforce download warnings for .ctl files from untrusted origins, and educate users on the risks of opening files from unknown senders. Monitor file access logs for suspicious .ctl file activity.

Patch guidance

Contact AzeoTech directly or consult their official security advisory to obtain the patched version of DAQFactory. Verify patch availability and apply it to all affected systems in your environment. Test patched versions in a non-production environment before enterprise rollout. If a patch is not yet available, apply compensating controls: restrict .ctl file handling to trusted sources, disable auto-execution of .ctl files where possible, and maintain strict file integrity monitoring.

Detection guidance

Monitor for suspicious .ctl file activity: look for unexpected .ctl file creation, modification, or execution from unusual network locations or by non-standard users. Track crash dumps and access violations within DAQFactory processes, which may indicate exploitation attempts. Check email gateways and file-sharing systems for inbound .ctl files from external sources. Use endpoint detection and response (EDR) tools to identify process execution anomalies following .ctl file opening. Maintain file integrity monitoring on .ctl files to detect tampering.

Why prioritize this

This vulnerability merits prompt remediation due to its HIGH CVSS score (7.8), low attack complexity, and direct path to code execution. Although user interaction is required, the prevalence of social engineering attacks and the critical nature of DAQFactory systems in operational environments make this a near-term risk. Organizations should prioritize patching within 30 days and implement compensating controls immediately.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a LOCAL attack vector (file must be opened locally), LOW complexity, NO privilege requirement, and HIGH impact across confidentiality, integrity, and availability. The score is elevated because successful exploitation grants full code execution. The primary limiting factor is the requirement for User Interaction, preventing an automatic network-based worm scenario. However, this does not diminish the severity in environments where file sharing or email-based workflows are common.

Frequently asked questions