VulnerabilityAnalyzed
CVE-2025-24865
The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensitive information and upload files without the associated password.
CRITICAL 10.0EPSS 7.25%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (7.25%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensitive information and upload files without the associated password.
- CVSS 4.0
- 10.0 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 7.25% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-306
- Affected
- myscada/mypro
- Source
- ics-cert@hq.dhs.gov
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-16Third Party Advisory, US Government Resource
- https://www.myscada.org/contacts/Product
- https://www.myscada.org/downloads/mySCADAPROManager/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.