CVE-2025-24865

Myscada Mypro vulnerability

10.0 CRITICALEPSS 7.25%

Published13 Feb 2025

Description

The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensitive information and upload files without the associated password.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Myscada Mypro< 1.4

Remediation

Fixed in

Myscada Mypro≥ 1.4

Frequently asked

Is CVE-2025-24865 being actively exploited?

CVE-2025-24865 is not in the CISA KEV catalog. Its EPSS exploit probability is 7.25%.

How severe is CVE-2025-24865?

CVE-2025-24865 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 7.25% probability of exploitation.

Which products are affected by CVE-2025-24865?

Affected products include Myscada Mypro.

How do I fix CVE-2025-24865?

Upgrade affected software to a fixed version, for example Myscada Mypro 1.4 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-24865 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.