CVE-2025-22896

CVE-2025-22896 is a vulnerability in mySCADA myPRO Manager, published on 2025-02-13, where the software stores credentials in cleartext. This issue, linked to CWE-312 (Cleartext Storage of Sensitive Information), carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), reflecting high severity primarily due to the risk of sensitive information disclosure.

The vulnerability can be exploited by any unauthenticated attacker with network access to the affected system, requiring low complexity and no user interaction. Exploitation enables the attacker to access and extract credentials stored in cleartext, resulting in high-impact confidentiality loss across the scoped impact.

Mitigation details are available in the CISA ICS advisory ICSA-25-044-16 at https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-16, along with mySCADA contacts at https://www.myscada.org/contacts/ and downloads at https://www.myscada.org/downloads/mySCADAPROManager/.