by Kastro
Paper/Archive/CVE-2025-24865

CVE-2025-24865

mySCADA myPRO Manager — mySCADA myPRO Manager Missing Authentication for Critical Function

EPSS 7%CVSS 10.0
critical.is priorityof 100
49
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 94.3.943 × 2018.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensitive information and upload files without the associated password.

Affected

ProductAffectedFixed inSource
myPRO Manager< 1.41.4CNA

Scores by source

icscert (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
icscert (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-25-044-16refmyscada.org/downloads/mySCADAPROManagerrefmyscada.org/contacts