All CISA Advisories, EN

mySCADA myPRO

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 9.3
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: mySCADA
  • Equipment: myPRO
  • Vulnerability: Use of Hard-coded Password

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to remotely execute code on the affected device.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following mySCADA products are affected:

  • myPRO: Versions prior to 8.31.0

3.2 Vulnerability Overview

3.2.1 USE OF HARD-CODED PASSWORD CWE-259

The affected application uses a hard-coded password which could allow an attacker to remotely execute code on the affected device.

CVE-2024-4708 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2024-4708. A base score of 9.3 has been calculated; the CVSS vector string is (CVSS4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Czech Republic

3.4 RESEARCHER

Nassim Asrir working with Trend Micro Zero Day Initiative reported this vulnerability to CISA.

4. MITI

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.

This article has been indexed from All CISA Advisories

Read the original article: