High severity7.8NVD Advisory· Published Jun 18, 2026· Updated Jul 15, 2026
CVE-2026-12390
CVE-2026-12390
Description
In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.
Affected products
2cpe:2.3:a:azeotech:daqfactory:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:azeotech:daqfactory:*:*:*:*:*:*:*:*range: <=21.1
- (no CPE)range: <=21.1
Patches
Vulnerability mechanics
References
1- www.cisa.gov/news-events/ics-advisories/icsa-26-169-02nvdUS Government ResourceMitigation
News mentions
2- ZDI-26-449: AzeoTech DAQFactory CTL File Parsing Type Confusion Remote Code Execution VulnerabilityZero Day Initiative · Jul 23, 2026
- AzeoTech DAQFactory (Update A)CISA ICS Advisories