title: AzeoTech DAQFactory
description: An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and trigger a man in the middle (MiTM) attack. This could allow an attacker to obtain credentials and take over the user’s cloud account.
problem types: CWE-471 Modification of Assumed-Immutable Data (MAID)
affected:
{
product: DAQFactory
vendor: AzeoTech
versions:
lessThanOrEqual: New version, status: affected, version: All versions, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
version: 3.1
]
workarounds: Users are discouraged from using documents from unknown/untrusted sources.
Users are encouraged to store .ctl files in a folder only writeable by admin-level users.
Users are encouraged to operate in “Safe Mode” when loading documents that have been out of their control.
Users are encouraged to apply a document editing password to their documents.
Users should avoid using the Real Time Web-Connect menu items and instead connect to DAQConnect using script.