Vulnerability details

CVE-2024-47407

mySCADA myPRO ManagermySCADA myPRO Runtime

mySCADA myPRO OS Command Injection

CVSS 4.0

10.0Critical

Official description

A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.

CVSS scores

Score	Version	Source	Vector
10.0Critical	4.0	CVEProject cvelistV5 (CNA) (icscert)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
10.0Critical	3.1	CVEProject cvelistV5 (CNA) (icscert)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
mySCADA	myPRO Manager	v < 1.3	CVEProject cvelistV5 (CNA)
mySCADA	myPRO Manager	v < 1.3	CISA ADP / Vulnrichment
mySCADA	myPRO Runtime	v < 9.2.1	CVEProject cvelistV5 (CNA)
mySCADA	myPRO Runtime	v < 9.2.1	CISA ADP / Vulnrichment

References and advisories

https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2024-11-23
Last updated: 2024-11-25
State: Published
Assigner (CNA): icscert

Exploit prediction (EPSS)

63.76%

Probability of exploitation in 30 days

99.2%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-78
OS Command Injection