ZDI-CAN-24785: ZDI-25-089: mySCADA myPRO Command Injection Remote Code Execution Vulnerability
Published Feb 19, 2025
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of mySCADA myPRO. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-20014.
Affected Software
1 affected component
mySCADA myPRO
Event History
Feb 19, 2025
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-24785?
The severity of ZDI-CAN-24785 is rated at 9.8 according to the CVSS score.
2
How do I fix ZDI-CAN-24785?
To fix ZDI-CAN-24785, update your mySCADA myPRO installation to the latest version provided by the vendor.
3
What systems are affected by ZDI-CAN-24785?
ZDI-CAN-24785 affects installations of mySCADA myPRO software.
4
Is authentication required to exploit ZDI-CAN-24785?
No, authentication is not required to exploit ZDI-CAN-24785.
5
What are the potential impacts of ZDI-CAN-24785?
The potential impact of ZDI-CAN-24785 includes the ability for remote attackers to execute arbitrary code.