CVE-2025-20061
Published: 29 January 2025
Description
mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system.
Security Summary
CVE-2025-20061 is a critical vulnerability in mySCADA myPRO, published on 2025-01-29, where the software fails to properly neutralize POST requests sent to a specific port containing email information. Classified as CWE-78 (OS Command Injection), it enables arbitrary command execution on the affected system and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited by any remote attacker with network access, requiring low attack complexity, no authentication privileges, and no user interaction. Successful exploitation allows the attacker to execute arbitrary commands, resulting in high impacts to confidentiality, integrity, and availability of the affected system.
Mitigation details are available in the CISA ICS Advisory ICSA-25-023-01 at https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-01.
Details
- CWE(s)