Skip to content
OpenAdvisories
Critical ICSA-24-326-07 5 CVEs

mySCADA myPRO Manager

Published Nov 21, 2024 · Updated Nov 21, 2024

Vendor: mySCADA Product: myPRO Manager Product: myPRO Runtime

Summary

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands or disclose sensitive information.

Vulnerabilities 5

  • Critical 10.0
    CVE-2024-47407 Public exploit EPSS 64%

    mySCADA myPRO OS Command Injection

    A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.

    mySCADA myPRO Manager myPRO Runtime
  • Critical 10.0
    CVE-2024-52034

    mySCADA myPRO OS Command Injection

    An OS Command Injection vulnerability exists within myPRO Manager. A parameter within a command can be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.

    mySCADA myPRO Manager myPRO Runtime
  • Critical 9.8
    CVE-2024-47138

    mySCADA myPRO Missing Authentication for Critical Function

    The administrative interface listens by default on all interfaces on a TCP port and does not require authentication when being accessed.

    mySCADA myPRO Manager myPRO Runtime
  • High 8.1
    CVE-2024-45369

    mySCADA myPRO Improper Authentication

    The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource.

    mySCADA myPRO Manager myPRO Runtime
  • High 7.5
    CVE-2024-50054

    mySCADA myPRO Path Traversal

    The back-end does not sufficiently verify the user-controlled filename parameter which makes it possible for an attacker to perform a path traversal attack and retrieve arbitrary files from the file system.

    mySCADA myPRO Manager myPRO Runtime

Revision history

  1. #1

    Initial Publication

References