Skip to content
OpenAdvisories
Critical ICSA-21-355-01 8 CVEs

mySCADA myPRO

Published Dec 21, 2021 · Updated Dec 21, 2021

Vendor: mySCADA Product: myPRO

Summary

Successful exploitation of these vulnerabilities could allow an attacker to completely compromise the products.

Vulnerabilities 8

  • Critical 10.0
    CVE-2021-22657

    mySCADA myPRO

    mySCADA myPRO: Versions 8.20.0 and prior has a feature where the API password can be specified, which may allow an attacker to inject arbitrary operating system commands through a specific parameter.

    mySCADA myPRO
  • Critical 10.0
    CVE-2021-23198

    mySCADA myPRO

    mySCADA myPRO: Versions 8.20.0 and prior has a feature where the password can be specified, which may allow an attacker to inject arbitrary operating system commands through a specific parameter.

    mySCADA myPRO
  • Critical 10.0
    CVE-2021-43981

    mySCADA myPRO

    mySCADA myPRO: Versions 8.20.0 and prior has a feature to send emails, which may allow an attacker to inject arbitrary operating system commands through a specific parameter.

    mySCADA myPRO
  • Critical 10.0
    CVE-2021-43984

    mySCADA myPRO

    mySCADA myPRO: Versions 8.20.0 and prior has a feature where the firmware can be updated, which may allow an attacker to inject arbitrary operating system commands through a specific parameter.

    mySCADA myPRO
  • Critical 10.0
    CVE-2021-44453

    mySCADA myPRO

    mySCADA myPRO: Versions 8.20.0 and prior has a vulnerable debug interface which includes a ping utility, which may allow an attacker to inject arbitrary operating system commands.

    mySCADA myPRO
  • Critical 9.8
    CVE-2021-43987

    mySCADA myPRO

    An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cannot be deleted or changed through the regular web interface.

    mySCADA myPRO
  • Critical 9.1
    CVE-2021-43985

    mySCADA myPRO

    An unauthenticated remote attacker can access mySCADA myPRO Versions 8.20.0 and prior without any form of authentication or authorization.

    mySCADA myPRO
  • High 7.5
    CVE-2021-43989

    mySCADA myPRO

    mySCADA myPRO Versions 8.20.0 and prior stores passwords using MD5, which may allow an attacker to crack the previously retrieved password hashes.

    mySCADA myPRO

Revision history

  1. #1

    ICSA-21-355-01 mySCADA myPRO

References