mySCADA vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-73807 The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions.Critical 9.3 · Sep 15, 2026
• CVE-2025-25067 mySCADA myPRO Manager is vulnerable to an OS command injection which could allow a remote attacker to execute arbitrary OS commands.Critical 9.3 · Feb 13, 2025
• CVE-2025-24865 The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensiCritical 10 · Feb 13, 2025
• CVE-2025-22896 mySCADA myPRO Manager stores credentials in cleartext, which could allow an attacker to obtain sensitive information.Critical 9.2 · Feb 13, 2025
• CVE-2025-20061 mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information.Critical 9.3 · Jan 29, 2025
• CVE-2025-20014 mySCADA myPRO does not properly neutralize POST requests sent to a specific port with version information.Critical 9.3 · Jan 29, 2025
• CVE-2024-52034 An OS Command Injection vulnerability exists within myPRO Manager.Critical 10 · Nov 22, 2024
• CVE-2024-50054 The back-end does not sufficiently verify the user-controlled filename parameter which makes it possible for an attacker to perform a path traversal attack and High 8.7 · Nov 22, 2024
• CVE-2024-47407 A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbiCritical 10 · Nov 22, 2024
• CVE-2024-47138 The administrative interface listens by default on all interfaces on a TCP port and does not require authentication when being accessed.Critical 9.3 · Nov 22, 2024
• CVE-2024-45369 The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource.Critical 9.2 · Nov 22, 2024
• CVE-2024-4708 mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device.Critical 9.3 · Jul 2, 2024
• CVE-2023-29169 mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.High 8.8 · Apr 27, 2023
• CVE-2023-29150 mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.High 8.8 · Apr 27, 2023
• CVE-2023-28716 mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.High 8.8 · Apr 27, 2023
• CVE-2023-28400 mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.High 8.8 · Apr 27, 2023
• CVE-2023-28384 mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.High 8.8 · Apr 27, 2023
• CVE-2022-2234 An authenticated mySCADA myPRO 8.26.0 user may be able to modify parameters to run commands directly in the operating system.Critical 9.9 · Aug 24, 2022
• CVE-2021-33013 mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive system information.High 8.2 · May 13, 2022
• CVE-2021-33009 mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to the file system.High 7.5 · May 13, 2022
• CVE-2021-33005 mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to arbitrary directories.High 7.5 · May 13, 2022
• CVE-2021-27505 mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive directory listing information.High 7.5 · May 13, 2022
• CVE-2022-0999 An authenticated user may be able to misuse parameters to inject arbitrary operating system commands into mySCADA myPRO versions 8.25.0 and prior.High 8.8 · Apr 11, 2022
• CVE-2021-44453 mySCADA myPRO: Versions 8.20.0 and prior has a vulnerable debug interface which includes a ping utility, which may allow an attacker to inject arbitrary operatiCritical 10 · Dec 23, 2021
• CVE-2021-43989 mySCADA myPRO Versions 8.20.0 and prior stores passwords using MD5, which may allow an attacker to crack the previously retrieved password hashes.High 7.5 · Dec 23, 2021