CVE-2026-82567

The myPRO Manager notification gateway from mySCADA exposes an unauthenticated HTTP endpoint that accepts a phone number and message body and sends the SMS through a connected GSM modem (CWE-862, missing authorization). Any attacker with network access to the gateway — typically someone already on the plant/OT network, consistent with the CVSS 4.0 adjacent attack vector — can submit a crafted HTTP request to send arbitrary text messages at the operator's expense. This could be abused to phish or socially engineer plant personnel with spoofed-looking alerts, run up carrier charges via premium-rate SMS, or flood the modem and disrupt legitimate alerting. Industrial and building-automation sites running myPRO with the notification gateway configured and a GSM modem attached are affected; the advisory does not specify exact versions. No public proof-of-concept exists, the flaw is not in the CISA KEV catalog, and no exploitation has been reported.

What to do: Restrict network access to the notification gateway so only trusted SCADA/management hosts can reach it (firewall allow-listing or VLAN segmentation), since exploitation requires adjacency to the gateway. If SMS alerting is not required, disable the notification gateway or disconnect the GSM modem. Review modem logs and carrier billing records for unexpected outbound messages, and apply the vendor's patched version as soon as one is released, checking the ICS-CERT advisory for affected version details.