DEV Community

OnaEiuspkz
OnaEiuspkz

Posted on

mySCADA myPRO Manager: Two Missing-Authorization Flaws in an ICS Management Platform (Operational View)

#vulnerability #ics #myscada #cve202673807

Unauthenticated SMS and Privileged API Access in mySCADA myPRO Manager

Vulnerability overview

Two authorization defects in mySCADA myPRO Manager were disclosed in a CISA advisory: CVE-2026-73807 at CVSS 9.8 and CVE-2026-82567 at CVSS 6.3. Both are missing-authorization issues in a platform that operators use to manage industrial processes. mySCADA Technologies shipped fixes in version 2.2, and no exploitation has been confirmed publicly.

Mechanism and exploitation conditions

The two flaws share a root cause but sit in different components, which matters for defenders because blocking one does not block the other.
CVE-2026-73807 is in the command API. The advisory says the API "does not properly enforce authentication for privileged functions," meaning the authorization check that should gate management operations is absent or ineffective. An unauthenticated caller with network access reaches those operations directly.
CVE-2026-82567 is in the notification gateway. The gateway publishes an HTTP endpoint for sending SMS through a GSM modem, and that endpoint accepts requests without an authentication check. A crafted request with a message payload causes the modem to transmit.
Neither flaw needs a prior foothold. The attacker needs a route to the service, nothing more.

Impact

The command API flaw is the more damaging of the two. Privileged management functions on a SCADA platform control what operators can see and change, so unauthenticated access to them lets an attacker alter system state or blind the people responsible for running the plant.
The SMS flaw is narrower but has a practical use. Messages sent through the plant's own modem inherit the credibility of the operator's infrastructure. An attacker can push convincing text to maintenance staff or on-call engineers, and the operator pays for the traffic. In environments where SMS is still the alerting channel, that is a meaningful path for follow-on attacks.

Affected products and scope

All mySCADA myPRO Manager installations at version 2.1 or earlier are affected. Version 2.2 contains the fix. The advisory does not identify a deployment mode that avoids the vulnerable code paths.

Exposure context

ZoomEye reported 651 assets matching title="mySCADA" on 2026-09-16. This is a product-deployment signal, not a vulnerability count: the query matches the product's page title and says nothing about version or endpoint exposure. Treat it as a rough measure of how much of this product sits on reachable networks.

Remediation and mitigations

Move to version 2.2. If that is not possible in the current maintenance window, cut off network access to both the command API and the notification gateway. Segment the management interface so only trusted administrative hosts can reach it, and disable the SMS gateway when the site does not depend on it.
Watch for unauthenticated requests to management endpoints and for SMS traffic that no operator triggered. Both are visible in normal logging if the logs are retained.

References

Top comments (0)