CVE-2024-4708

The mySCADA myPRO software contains a static hardcoded password that cannot be changed by the user in the standard way. An attacker who knows this password can authenticate to the system without knowing the correct credentials. After gaining access, remote code execution (RCE) on the device is possible, without the need for any privileges or user interaction.

An attacker can remotely execute arbitrary code on the vulnerable device, leading to complete loss of confidentiality, integrity, and availability of the system. In the context of SCADA industrial systems, this can result in disruption or takeover of control over industrial processes.

Patches available from the manufacturer should be applied in accordance with references — details in CISA advisory ICSA-24-184-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-02) and on the mySCADA manufacturer's website.

mySCADA myPRO — versions indicated in manufacturer references (CISA advisory ICSA-24-184-02)