Critical mySCADA myPRO Flaws Could Let Attackers Take Over Industrial Control Systems
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-20014 | mySCADA myPRO does not properly neutralize POST requests sent to a specific port with version information. mySCADA myPRO does not properly neutralize POST requests sent to a specific port with version information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system. NVD description · AI analysis pending | 9.3 | 1% | — | — | ||
| CVE-2025-20061 | mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information. mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system. NVD description · AI analysis pending | 9.3 | 1% | — | — |
Full article288 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 19, 2025Vulnerability / Network Security
Cybersecurity researchers have disclosed details of two critical flaws impacting mySCADA myPRO, a Supervisory Control and Data Acquisition (SCADA) system used in operational technology (OT) environments, that could allow malicious actors to take control of susceptible systems.
"These vulnerabilities, if exploited, could grant unauthorized access to industrial control networks, potentially leading to severe operational disruptions and financial losses," Swiss security company PRODAFT said.
The list of shortcomings, both rated 9.3 on the CVSS v4 scoring system, are below -
- CVE-2025-20014 - An operating system command injection vulnerability that could permit an attacker to execute arbitrary commands on the affected system via specially crafted POST requests containing a version parameter
- CVE-2025-20061 - An operating system command injection vulnerability that could permit an attacker to execute arbitrary commands on the affected system via specially crafted POST requests containing an email parameter
Successful exploitation of either of the two flaws could permit an attacker to inject system commands and execute arbitrary code. The issues have been addressed in the following versions -
- mySCADA PRO Manager 1.3
- mySCADA PRO Runtime 9.2.1
According to PRODAFT, both vulnerabilities stem from a failure to sanitize user inputs, thereby opening the door to a command injection.
"These vulnerabilities highlight the persistent security risks in SCADA systems and the need for stronger defenses," the company said. "Exploitation could lead to operational disruptions, financial losses, and safety hazards."
Organizations are recommended to apply the latest patches, enforce network segmentation by isolating SCADA systems from IT networks, enforce strong authentication, and monitor for suspicious activity.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/03/critical-myscada-mypro-flaws-could-let.html