CVE-2025-24865 | The administrative web interface of mySCADA myPRO Manager … | CVSS 10.0 CRITICAL

Description

The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensitive information and upload files without the associated password.

Metadata

CVE ID: CVE-2025-24865
State: PUBLISHED
Assigner: icscert
Reserved: 2025-02-11 00:04 UTC
Published: 2025-02-13 21:29 UTC
Last updated: 2025-02-14 15:47 UTC
Primary CWE: CWE-306
CWE-306 Missing Authentication for Critical Function
Vendor / Product: mySCADA / myPRO Manager
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
mySCADA	myPRO Manager	—	0 < 1.4

Weakness (CWE)

CWE	Source	Description
CWE-306	cna	CWE-306 Missing Authentication for Critical Function

CVSS scores (2)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References (3)