CVE-2025-24865

10.0 criticalEPSS 7.2%

Critical (10.0) in myscada mypro. EPSS 7.2% chance of exploitation in the next 30 days.

The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensitive information and upload files without the associated password.

Severity

CVSS 4.0

10.0 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 7.2% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2025-02-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

myscada:mypro

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-16
https://www.myscada.org/contacts/
https://www.myscada.org/downloads/mySCADAPROManager/

Check your stack JSON