Read the docs
TI-2024-31721 Aliases CVE-2024-47407GHSA-hc88-rhv5-92jq

mySCADA myPRO OS Command Injection

Priority HIGH 84CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.63766 99th percentileScored 2026-11-07
Fix Fixed myPRO Manager (mySCADA): 1.3myPRO Runtime (mySCADA): 9.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mySCADAmyPRO Managerbefore 1.31.3Patch availableCNA
mySCADAmyPRO Runtimebefore 9.2.19.2.1Patch availableCNA
  • myPRO Manager VendormySCADA Affected before 1.3 Fixed in 1.3 Patch available CNA
  • myPRO Runtime VendormySCADA Affected before 9.2.1 Fixed in 9.2.1 Patch available CNA

CPE names CISA-ADP · 2

CPEVersionsRoleVendor
cpe:2.3:a:myscada:mypro_manager:*:*:*:*:*:*:*:*——mySCADA
cpe:2.3:a:myscada:mypro_runtime:*:*:*:*:*:*:*:*——mySCADA
  • cpe:2.3:a:myscada:mypro_manager:*:*:*:*:*:*:*:* Versions — — ·mySCADA
  • cpe:2.3:a:myscada:mypro_runtime:*:*:*:*:*:*:*:* Versions — — ·mySCADA

Remediation

  • Fix · CNA myPRO Manager (mySCADA) Fixed in 1.3
  • Fix · CNA myPRO Runtime (mySCADA) Fixed in 9.2.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    mySCADA myPRO Manager, myPRO Runtime 1.3, 9.2.1

    5 records Highest priority Priority HIGH 1 HIGH, 4 MEDIUM

    Other records, highest priority first

    • TI-2024-34919 mySCADA myPRO OS Command InjectionPriority MEDIUM 52
    • TI-2024-31510 mySCADA myPRO Missing Authentication for Critical FunctionPriority MEDIUM 49
    • TI-2024-33499 mySCADA myPRO Path TraversalPriority MEDIUM 45
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-47407
  2. 2026-10-03 Alias added: GHSA-hc88-rhv5-92jq

References

Other 1

  • TI-2022-02063 mySCADA myPRO Command Injection CVSS 3.1CRITICAL 9.9
  • TI-2023-12930 OS command injection in mySCADA myPRO CVSS 3.1HIGH 8.8
  • TI-2023-12946 OS command injection in mySCADA myPRO CVSS 3.1HIGH 8.8
  • TI-2021-19445 Path traversal in mySCADA myDESIGNER CVSS 3.1HIGH 7.8
  • TI-2025-18574 mySCADA myPRO Manager Missing Authentication for Critical Function CVSS 4.0CRITICAL 10.0
  • TI-2018-08060 A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in… CVSS 3.0CRITICAL 9.1
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences