PT-2026-7050 · Hmiweb+5 · Hmiweb+5

Published 2026-02-09 · Updated 2026-03-05 · CVE-2025-66602

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FAST/TOOLS versions R9.01 through R10.04

Description The web server component accepts access by IP address, potentially allowing exploitation by worms that randomly search for IP addresses. This could lead to unauthorized access if a worm intrudes into the network. The affected packages are RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB.

Recommendations FAST/TOOLS versions R9.01 through R10.04 should be updated to a newer, secure version.

Fix

Weakness Enumeration

CWE-291

Related Identifiers

BDU:2026-01846

CVE-2025-66602

Affected Products

Fast/Tools

Ftees

Hmimob

Hmiweb

Rvsvrn

Unsvrn

References · 7

• https://bdu.fstec.ru/vul/2026-01846 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66602 · Security Note
• https://web-material3.yokogawa.com/1/39206/files/YSAR-26-0001-E.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66602 · Vendor Advisory
• https://t.me/CVEtracker/44163 · Telegram Post
• https://t.me/cveNotify/151355 · Telegram Post
• https://t.me/cveNotify/154308 · Telegram Post