mySCADA myPRO Manager
Plan PatchCVSS 9.8ICS-CERT ICSA-26-258-03Sep 15, 2026
mySCADAEnergy
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
mySCADA Pro Manager versions 2.1 and earlier contain authentication bypass vulnerabilities (CWE-862, CWE-306) that allow an unauthenticated attacker on the network to access privileged management functions and send arbitrary SMS messages through connected GSM modems. The issues are resolved in Version 2.2.
What this means
What could happen
An attacker on your network could gain unauthorized access to the mySCADA Pro Manager's administrative functions without credentials, allowing them to modify SCADA system settings or send unauthorized SMS messages through any connected cellular modem.
Who's at risk
Energy sector operators running mySCADA Pro Manager for SCADA system management should prioritize this update. This affects any SCADA control system using mySCADA Pro Manager version 2.1 or earlier, particularly those with remote or GSM-based monitoring and control capabilities.
How it could be exploited
An attacker on your network sends a request to the mySCADA Pro Manager application (which listens on the network). Due to missing authentication checks, the attacker gains access to privileged management functions without providing credentials. From there, the attacker can reconfigure system settings or trigger the GSM modem to send arbitrary SMS messages.
Prerequisites
- Network access to the mySCADA Pro Manager application port
- mySCADA Pro Manager version 2.1 or earlier
- GSM modem connected to the system (for SMS exploit)
remotely exploitableno authentication requiredlow complexityaffects management functions
Exploitability
Unlikely to be exploited — EPSS score 0.8%
Affected products (1)
ProductAffected VersionsFix Status
mySCADA myPRO Manager≤ 2.1No fix yet
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDRestrict network access to the mySCADA Pro Manager application to authorized engineering workstations only using firewall rules
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate mySCADA Pro Manager to version 2.2 or later
Long-term hardening
0/1HARDENINGSegment the mySCADA Pro Manager onto a dedicated management network isolated from field devices and untrusted networks
CVEs (2)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/ead54a01-7e34-4056-b991-dbd33e404809Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.