On July 23, 2026, the TrendAI Zero Day Initiative disclosed vulnerability ZDI-26-450, tracked as CVE-2026-12921, affecting AzeoTech DAQFactory versions 21.1 and earlier. The flaw enables arbitrary code execution through a use-after-free in the parser for .ctl files, the proprietary configuration format for this HMI/SCADA software. User interaction is a necessary condition: opening a malicious file or visiting a crafted web page triggers the attack chain.
The initial report dates to March 2, 2026. AzeoTech has released a corrective update, but the roughly 143-day exposure window demands immediate verification of installation status in industrial systems where DAQFactory manages operator interfaces and data acquisition.
- CVE-2026-12921, CVSS 4.0: 8.4 HIGH, affects DAQFactory ≤21.1: use-after-free in .ctl parsing with code execution in the current process.
- Attack condition: mandatory user interaction (opening a file or visiting a malicious page); no known public exploitation at the time of the CISA advisory.
- Target sector: Critical Manufacturing, with vendor headquarters in the United States.
- The same CISA advisory ICSA-26-169-02 also covers a related Type Confusion vulnerability (CWE-843) in the same versions; a separate CVE is not specified in the documentation reviewed.
The Technical Mechanism: Why a .ctl File Becomes Executable
The core of the flaw lies in the parser for the .ctl format, used by DAQFactory to store channel configurations, HMI screens, and automation logic. According to the ZDI-26-450 advisory:
"The specific flaw exists within the parsing of CTL files. The issue results from the lack of validating the existence of an object prior to performing operations on the object." — ZDI-26-450 advisory
The missing check on object existence before dereferencing creates a use-after-free condition: the pointer continues to reference a memory region that has already been freed, which an attacker can reoccupy with controlled data. This leads to arbitrary code execution in the context of the DAQFactory process, with the privileges of the user who opened the file.
The local vector (AV:L in CVSS 3.1, confirmed by the same structure in version 4.0) does not diminish the severity: in SCADA systems, configuration files circulate via email among plant technicians, integrators, and vendor support. A seemingly legitimate .ctl file — perhaps named to evoke a backup or firmware update — raises no suspicion in a maintenance team's routine operations.
CVSS 4.0 at 8.4: Reading the Scores in Industrial Context
The CVE Record assigns the vulnerability a CVSS 4.0 score of 8.4, rated HIGH. The full vector is AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The CISA advisory ICSA-26-169-02 reports a CVSS 3.1 score of 7.8, also HIGH, with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The two scales are not numerically comparable, but they agree on the severity classification and key parameters: local attack, no privileges required, maximum impact on confidentiality, integrity, and availability.
The difference between the two scores reflects the evolution of the metric: version 4.0 more cleanly separates the scope of impact (VC, VI, VA) and introduces the atomicity target (AT:N, no sequential requirement). The absence of impact on subsequent systems (SC:N/SI:N/SA:N) aligns with DAQFactory's architecture: a single process, without automatic escalation to system services.
Social Engineering as an Interface Forcer
The user interaction condition, documented verbatim in the ZDI advisory — "User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file" — shifts the problem from the purely technical domain to that of file-handling procedures in the industrial environment.
Plant technicians receive .ctl files daily from integrators, colleagues at other sites, or technical support. The supply chain for these configuration objects is opaque: they are rarely signed, never scanned by antimalware solutions specialized for proprietary SCADA formats. The CISA advisory underscores:
"Successful exploitation of these vulnerabilities could allow an attacker to upload malicious .ctl files that may lead to arbitrary code execution." — CISA ICS Advisory ICSA-26-169-02
The verb "upload" in the CISA context does not imply a remote attack without interaction: it refers to the attacker's ability, given the user interaction condition, to deliver the file to the target system through ordinary technical document-exchange channels.
What to Do Now
Priority actions derive directly from the sources consulted:
- Verify the installed DAQFactory version and compare it against the 21.1 threshold: all versions up to this are vulnerable, per the CVE Record.
- Apply the update released by AzeoTech, cited in the ZDI advisory as available; the source does not specify the patched version number or the distribution mechanism.
- Scrutinize .ctl files in transit through the plant's technical communication channels: email, USB drives, shared repositories. The CISA advisory does not indicate digital signatures or verified channels as mitigations, but awareness of provenance reduces the attack surface.
- Monitor CISA advisory ICSA-26-169-02 for any updates on the paired Type Confusion vulnerability, whose CVE identifier is not determined in the analyzed documents.
The Exposure Window and the Patch Problem in Industrial Systems
Approximately 143 days separate the private report of March 2, 2026, from the public disclosure of July 23. This timeline is typical for the ZDI program, but in the Critical Manufacturing sector it represents a critical interval: software updates on HMI/SCADA systems require scheduled maintenance windows, functional validation, and often operational risk management approvals.
The CISA advisory, dated in the ICS calendar as 26-169-02 (publication corresponding to July 2026), reports no active exploitation. This assertion, valid at the time of publication, is not static: the public release of technical details — particularly the UAF nature in the .ctl parser — lowers the barrier for proof-of-concept development by actors with access to the software.
The ZDI report attributes discovery to Rocco Calvi (@TecR0c) of TecSecurity and collaboration by rgod with the TrendAI ZDI program. The dual attribution reflects a structured reporting chain, not a direct vendor report. This model — independent researcher, ZDI coordinator, coordinated disclosure — is standard in the industrial vulnerability ecosystem, but introduces latencies that critical operational systems pay for in exposure.
The most significant gap in the dossier is the lack of detail on the AzeoTech update: exact version, availability for supported or end-of-life licenses, presence of release notes. Without these data, verifying the protection status of an installation requires direct contact with the vendor.
Sources
- http://www.zerodayinitiative.com/advisories/ZDI-26-450/
- http://www.zerodayinitiative.com/advisories/published/
- https://www.cve.org/CVERecord?id=CVE-2026-12921
- http://www.zerodayinitiative.com/advisories/upcoming/
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-02
Information verified against cited sources and current as of publication.