Vulnerability · Published Feb 13, 2025 · Assigned by icscert
CVE-2025-24865mySCADA myPRO Manager Missing Authentication for Critical Function
Critical 10.0
In plain English
A critical-severity missing authentication in myPRO Manager from mySCADA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.2% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)7.2%top 5.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Metasploit
Official description
The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensitive information and upload files without the associated password.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mySCADA | myPRO Manager | 0 – before 1.4 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H