DEV Community

kozhevniko
kozhevniko

Posted on

Two Ways Into mySCADA myPRO Manager: A Privileged API and an Open SMS Gateway

#vulnerability #ics #myscada #cve202673807

Two Ways Into mySCADA myPRO Manager: A Privileged API and an Open SMS Gateway

Vulnerability overview

A CISA advisory describes two authorization flaws in mySCADA myPRO Manager. CVE-2026-73807 scores 9.8 and affects the command API. CVE-2026-82567 scores 6.3 and affects the notification gateway. mySCADA Technologies addressed both in version 2.2. There is no confirmed exploitation as of the advisory.

Mechanism and exploitation conditions

The command API flaw is the higher-severity of the pair. According to the advisory, the API "does not properly enforce authentication for privileged functions." Privileged functions are exactly what an attacker wants on a SCADA management platform, and the API does not verify that the caller is entitled to them.
The notification gateway flaw is narrower. The gateway runs an HTTP endpoint that sends SMS through a GSM modem, and it does not authenticate callers. A single request with a message body causes a send.
In both cases the attacker needs only a network path to the service. Credentials, tokens, and prior access are not part of the exploit conditions.

Impact

Unauthenticated access to privileged management functions is the primary risk. An attacker can reach operations that shape what the control system does and what operators see, which in a live plant can mean disrupted processes or a degraded view of system state.
The SMS gateway produces a different kind of harm. Messages sent through the plant's modem carry the plant's identity, which makes them effective in social engineering against staff, and they bill the operator for the traffic.

Affected products and scope

mySCADA myPRO Manager 2.1 and earlier is affected. Version 2.2 fixes the issues. The advisory does not identify a configuration that sidesteps the vulnerable code, so any deployment of the affected versions should be treated as exposed.

Exposure context

ZoomEye returned 651 assets for title="mySCADA" on 2026-09-16. The query matches the product's page title, so the figure reflects how many reachable systems present the product rather than how many are vulnerable. Version and endpoint status are outside the query's scope.

Remediation and mitigations

Upgrade to version 2.2 and verify it took effect. Where the upgrade is delayed, restrict network access to the command API and the notification gateway, and disable the SMS gateway if the site does not rely on it.
Detection options include alerting on unauthenticated management API calls and on SMS transmissions that no operator initiated.

References

Top comments (0)