DEV Community

yutianle
yutianle

Posted on

mySCADA myPRO Manager: Two Missing-Authorization Flaws in an ICS Management Platform (Control Network Focus)

#vulnerability #ics #myscada #cve202673807

What the mySCADA myPRO Manager Authorization Flaws Mean for Control Networks

Vulnerability overview

mySCADA myPRO Manager carries two missing-authorization vulnerabilities, CVE-2026-73807 (CVSS 9.8) and CVE-2026-82567 (CVSS 6.3), according to a CISA advisory. mySCADA Technologies fixed both in version 2.2. No public exploitation has been reported.

Mechanism and exploitation conditions

CVE-2026-73807 concerns the command API. The advisory notes that the API "does not properly enforce authentication for privileged functions." The endpoint exists to let administrators manage the platform, but it does not establish that the caller is authorized before acting.
CVE-2026-82567 concerns the notification gateway. That gateway exposes an HTTP endpoint that sends SMS messages through a connected GSM modem, and the endpoint performs no authentication. Anyone who can reach it can ask the modem to transmit a message of their choosing.
Both flaws are reachable without credentials. The only precondition is network access to the relevant service, which in many plants is a matter of which VLAN the attacker already sits on.

Impact

Unauthenticated access to management functions is the serious outcome. An attacker can change what the control system reports and, depending on configuration, affect how it behaves. For operators in manufacturing, energy, water, or transportation, that translates into lost visibility and potential process disruption.
The SMS gateway gives an attacker a channel that looks internal. Messages arrive from the plant's own number, which makes them more persuasive than an external phishing attempt. The operator also absorbs the cost of the traffic.

Affected products and scope

Version 2.1 and earlier of mySCADA myPRO Manager is affected. Version 2.2 resolves the issues. The advisory does not describe a safe configuration short of upgrading, which suggests the flaws are in code paths the product uses routinely.

Exposure context

On 2026-09-16, a ZoomEye search for title="mySCADA" returned 651 assets. The number reflects how many reachable systems present the product's title, not how many are vulnerable. Version and endpoint exposure are not part of that query, so the count should inform prioritization rather than drive it.

Remediation and mitigations

Upgrade to version 2.2 and verify the running version afterwards. Until that happens, isolate the command API and the notification gateway from any network an attacker could reach, and turn the SMS gateway off if the site does not use it.
For detection, look at management endpoint access logs for requests without authentication and at modem activity for sends that no operator scheduled. Both are straightforward to alert on once the endpoints are known.

References

Top comments (0)