Critical Vulnerabilities Discovered in mySCADA myPRO Manager
Two critical vulnerabilities in mySCADA myPRO Manager allow unauthenticated attackers to access privileged management functions and send arbitrary SMS via connected GSM modems, affecting versions through 2.1.
Why it matters
These vulnerabilities expose critical infrastructure sectors to risks of unauthorized management access and potential misuse of communication functions, which may affect system reliability and operational safety.
SOC impact
Monitor for unauthorized access attempts targeting myPRO Manager instances. Investigate unusual SMS traffic originating from systems running affected versions. Confirm deployment of version 2.2 or later to ensure mitigation is applied.
Recommended actions
- Identify assets running mySCADA myPRO Manager versions up to 2.1
- Monitor authentication logs for unauthorized management access attempts
- Review outbound SMS activity on connected GSM modems for anomalies
- Confirm deployment of myPRO Manager version 2.2 or later
- Consult the CISA advisory for detailed vulnerability information
Executive Summary
Two critical vulnerabilities have been identified in mySCADA myPRO Manager versions up to 2.1. These issues allow unauthenticated attackers to gain access to privileged management functions and send arbitrary SMS messages via connected GSM modems. This increases the risk of unauthorized control over devices critical to infrastructure sectors and misuse of telecom functions, which may impact operational controls. Mitigated versions are available starting with version 2.2. Defenders should validate their exposure by identifying affected assets, monitoring management access and SMS traffic, and ensuring timely deployment of fixes as outlined by the official CISA advisory.
SOC Impact
Monitor for unauthorized access attempts targeting myPRO Manager instances. Investigate unusual SMS traffic originating from systems running affected versions. Confirm deployment of version 2.2 or later to ensure mitigation is applied.
What SOC Teams Should Validate
- Identify assets running mySCADA myPRO Manager versions up to 2.1
- Monitor authentication logs for unauthorized management access attempts
- Review outbound SMS activity on connected GSM modems for anomalies
- Confirm deployment of myPRO Manager version 2.2 or later
- Consult the CISA advisory for detailed vulnerability information
Why It Matters
These vulnerabilities expose critical infrastructure sectors to risks of unauthorized management access and potential misuse of communication functions, which may affect system reliability and operational safety.