CVE-2026-12390

HIGH

Access of resource using incompatible type ('type confusion') in AzeoTech DAQFactory

Title source: cna

Description

In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.

References (1)

Core 1

Core References

Government Resource government-resource

https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-02

Scores

CVSS v3 7.8

EPSS 0.0014

EPSS Percentile 3.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-843

Status published

Products (2)

AzeoTech/DAQFactory < 21.1

azeotech/daqfactory < 21.1

Published Jun 18, 2026

Tracked Since Jun 19, 2026