CVE-2025-24865

critical · 10

The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensitive information and upload files without the associated password.

CVSS

7.2%

EPSS (exploit prob.)

94th

EPSS percentile

2025-02-13

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-306

Affected products

Vendor	Product	Affected versions
myscada	mypro	< 1.4

Check a specific version with /api/v1/cve/match.

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-16
https://www.myscada.org/contacts/
https://www.myscada.org/downloads/mySCADAPROManager/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-24865