CVE-2014-7251: XML external entity (XXE) vulnerability in the WebHMI server in Yokogawa Electric Corporation FAST/TOOLS be...

Security readout for executives and security teams

Yokogawa FAST/TOOLS WebHMI versions before R9.05-SP2 have an XML parsing flaw that can let a local user read files or consume CPU or network resources. The public record does not show active exploitation or a CVSS score, but affected operational technology environments should treat this as a real availability and information exposure risk. Exposure is likely limited to organizations running Yokogawa FAST/TOOLS WebHMI before R9.05-SP2, especially where local users can access the WebHMI server. The bundle does not identify broader product families, internet exposure, or affected configurations beyond FAST/TOOLS WebHMI. Prioritize remediation for any production OT environment running FAST/TOOLS WebHMI before R9.05-SP2. The urgency is moderate: exploitation appears local, but the potential impact includes file disclosure and denial of service in industrial operations. Mitigation focus: Upgrade FAST/TOOLS to R9.05-SP2 or later where applicable.; Review Yokogawa advisory YSAR-14-0004E for vendor-specific guidance.; Limit WebHMI server access to authorized users only..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.