CVE-2018-11311

The CVE-2018-11311 entry concerns mySCADA myPRO 7, where the FTP server’s credentials are hardcoded (username: myscada, password: Vikuk63) in mys cadagate.exe. This allows remote authentication to the FTP service on port 2121, enabling actions such as uploading files or listing directories. Conne...

CVE-2025-24865

The CVE-2025-24865 entry concerns mySCADA myPRO Manager where the administrative web interface can be accessed without authentication. The connected documents describe that this could let an attacker retrieve sensitive information and upload files without credentials, and the PT-2025-7040 entry a...

CVE-2023-28384

CVE-2023-28384 affects mySCADA myPRO (versions 8.26.0 and earlier). An authenticated user can exploit parameters to inject arbitrary operating system commands, with the commands executed under NT AUTHORITY\SYSTEM. Public sources (including CISA ICS advisory) confirm remote exploitable OS command ...

CVE-2025-22896

CVE-2025-22896 affects mySCADA myPRO Manager, where credentials are stored in cleartext. The vulnerability enables an attacker to obtain sensitive information via the affected component, with network access and no required user interaction per CVSS vectors in the source records. Connected documen...

CVE-2021-33005

CVE-2021-33005 is a path traversal vulnerability in mySCADA myPRO prior to version 8.20.0. An unauthenticated remote attacker can upload arbitrary files to arbitrary directories by exploiting improper filtering of path components. Affected product: mySCADA myPRO (industrial HMI/SCADA). Impact des...

CVE-2021-33009

CVE-2021-33009 affects mySCADA myPRO prior to version 8.20.0. An unauthenticated remote attacker can upload arbitrary files to the file system due to an unrestricted upload vulnerability (CWE-434). CVSSv3 base score 7.5 (HIGH) with network access and no authentication; impact on integrity is HIGH...

CVE-2025-25067

CVE-2025-25067 affects mySCADA myPRO Manager (HMI/SCADA). An OS command injection vulnerability originates from improper input validation, enabling a remote attacker to execute arbitrary OS commands over the network. CISA/ICS guidance notes the administrative web interface can be accessed without...

CVE-2022-0999

CVE-2022-0999 affects mySCADA myPRO, versions 8.25.0 and earlier. It stems from improper neutralization of special elements used in a command (CWE-77) that allows an authenticated user to inject arbitrary operating system commands. Impacts reported include high-severity outcomes (CVE metrics show...

CVE-2021-33013

The CVE-2021-33013 vulnerability affects mySCADA myPRO prior to version 8.20.0, where an improper access control allows unauthenticated read access to sensitive system information. This is documented across multiple sources (NVD entry and ICSA briefing) with CVSS v3 base score up to 8.2 (HIGH) an...

CVE-2023-29169

Summary (CVE-2023-29169) mySCADA myPRO versions 8.26.0 and prior are affected by an OS command injection vulnerability. An authenticated user can exploit parameters with insufficient validation to inject arbitrary operating system commands. This is documented in multiple sources (including Red Ha...

CVE-2021-27505

CVE-2021-27505 affects mySCADA myPRO prior to 8.20.0. The exposed issue is Exposure of Information Through Directory Listing due to improper access control, allowing unauthorized read access to sensitive directory listing information. Affected product: myPRO (industrial HMI/SCADA) with versions b...

CVE-2025-23411

CVE-2025-23411 affects the mySCADA myPRO Manager. The connected sources confirm a cross-site request forgery (CSRF) vulnerability that could allow an attacker to obtain sensitive information by tricking a user to visit a malicious site. The vulnerability details across sources consistently descri...

CVE-2024-4708

The connected advisories confirm CVE-2024-4708 affects mySCADA myPRO (versions before 8.31.0) due to a hard-coded credential in the telnet service (listening on TCP 5005). This could enable remote code execution over the network without authentication, running with the service account. Remediatio...

CVE-2023-28400

CVE-2023-28400 affects mySCADA myPRO, versions 8.26.0 and earlier. The vulnerability arises from parameters that an authenticated user can abuse to inject arbitrary operating system commands (OS Command Injection, CWE-78). Exploitation is described as possible remotely with low attack complexity ...

CVE-2022-2234

CVE-2022-2234 affects mySCADA myPRO HMI/SCADA (versions prior to 8.26.0; 8.26.0 and earlier). It stems from improper neutralization of special elements in commands, enabling an authenticated user to modify parameters to execute OS commands (command injection). Impact described as high across conf...

CVE-2021-44453

Affected product: mySCADA myPRO (versions 8.20.0 and prior). Vulnerability: OS command injection via a vulnerable debug interface that includes a ping utility, allowing an attacker to inject arbitrary operating system commands through the interface. Impact (as stated): Remote code execution with ...

CVE-2017-12730

CVE-2017-12730 concerns an Unquoted Search Path vulnerability in mySCADA myPRO (versions 7.0.26 and earlier). The root cause is application services using unquoted search path elements, enabling an attacker with local, authenticated access and low exploitation complexity to execute arbitrary code...

CVE-2023-29150

CVE-2023-29150 affects mySCADA myPRO up to version 8.26.0 and earlier, due to parameters that authenticated users can abuse to inject OS commands. Public sources (NVD/Red Hat CNVD/ICS advisories) confirm OS command injection with high impact (C/H, I/H, A/H) and note remote exposure in advisories,...

CVE-2021-22657

CVE-2021-22657 affects mySCADA myPRO, with versions 8.20.0 and earlier vulnerable to OS command injection through a parameter (API password or related field). The root cause is improper handling/neutralization of input that allows an attacker to execute arbitrary commands on the underlying system...

CVE-2021-43987

CVE-2021-43987 affects mySCADA myPRO up to version 8.20.0. A hidden, nondocumented administrative account exists that is not exposed via the web interface and cannot be deleted or changed through the regular interface. The issue is the presence of this backdoor-like account, leading to high-sever...

CVE-2021-43985

CVE-2021-43985 affects mySCADA myPRO, with an authentication bypass vulnerability in versions 8.20.0 and prior. An unauthenticated remote attacker can access the application without authentication or authorization via an alternative path/channel. The ICS advisory (ICSA-21-355-01) documents this v...

CVE-2023-28716

CVE-2023-28716 affects mySCADA myPRO 8.26.0 and earlier. Affected component: parameters handling in myPRO that allow an authenticated user to inject arbitrary operating system commands (OS command injection). Root cause: improper validation/handling of command-related parameters leading to code e...

CVE-2021-23198

CVE-2021-23198 affects mySCADA myPRO before version 8.22.0. The vulnerability is an OS command injection stemming from a feature where a password/parameter can be specified, enabling an attacker to inject arbitrary operating system commands. Various connected sources (NVD/NVD-derived CVSS metrics...

CVE-2021-43984

The CVE-2021-43984 issue affects mySCADA myPRO up to version 8.20.0, where the firmware update feature may allow an attacker to inject arbitrary OS commands via a specific parameter. The vulnerability is categorized as an OS command injection with a high to critical impact (C/H/I/H) in multiple s...

CVE-2018-11517

Summary: CVE-2018-11517 affects mySCADA myPRO 7, enabling remote attackers to enumerate all ProjectIDs in a project by sending all of the prj parameter values from 870000 to 875000 in t=0&rq=0 requests to TCP port 11010. The vulnerability is a information disclosure issue (project IDs exposed). W...

CVE-2021-43989

The CVE-2021-43989 issue affects mySCADA myPRO versions 8.20.0 and earlier, where passwords are stored using MD5. The underlying risk is that MD5 password hashes may be cracked, exposing credential-related data. Reported in multiple sources (NVD/NVD-derived and ICS/CISA context), the vulnerabilit...

CVE-2021-43981

The CVE-2021-43981 entry concerns mySCADA myPRO, affected up to version 8.20.0. The vulnerability is an OS command injection flaw introduced by a feature that sends emails, where a specific parameter can be exploited to inject arbitrary OS commands. Multiple connected sources (NVD entry, ICS advi...