www.cisa.gov
Open in
urlscan Pro
184.30.73.183
Public Scan
URL:
https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07
Submission: On November 22 via api from TR — Scanned from CA
Submission: On November 22 via api from TR — Scanned from CA
Form analysis 2 forms found in the DOM
<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
<table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<div class="gsc-input-box" id="gsc-iw-id1">
<table cellspacing="0" cellpadding="0" role="presentation" id="gs_id50" class="gstl_50 gsc-input" style="width: 100%; padding: 0px;">
<tbody>
<tr>
<td id="gs_tti50" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id1" dir="ltr" spellcheck="false"
style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
<td class="gsib_b">
<div class="gsst_b" id="gs_st50" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb50" aria-hidden="true">×</span></a></div>
</td>
</tr>
</tbody>
</table>
</div>
</td>
<td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
<title>search</title>
<path
d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
</path>
</svg></button></td>
<td class="gsc-clear-button">
<div class="gsc-clear-button" title="clear results"> </div>
</td>
</tr>
</tbody>
</table>
</form><form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
<table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<div class="gsc-input-box" id="gsc-iw-id2">
<table cellspacing="0" cellpadding="0" role="presentation" id="gs_id51" class="gstl_51 gsc-input" style="width: 100%; padding: 0px;">
<tbody>
<tr>
<td id="gs_tti51" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id2" dir="ltr" spellcheck="false"
style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
<td class="gsib_b">
<div class="gsst_b" id="gs_st51" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb51" aria-hidden="true">×</span></a></div>
</td>
</tr>
</tbody>
</table>
</div>
</td>
<td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
<title>search</title>
<path
d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
</path>
</svg></button></td>
<td class="gsc-clear-button">
<div class="gsc-clear-button" title="clear results"> </div>
</td>
</tr>
</tbody>
</table>
</form>Text Content
Skip to main content
An official website of the United States government
Here’s how you know
Here’s how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United
States.
Secure .gov websites use HTTPS
A lock (LockA locked padlock) or https:// means you’ve safely connected to the
.gov website. Share sensitive information only on official, secure websites.
Free Cyber ServicesElection Threat Updates#protect2024Secure Our WorldShields
UpReport A Cyber Issue
Search
×
search
Menu
Close
×
search
* Topics
Topics
Cybersecurity Best Practices
Cyber Threats and Advisories
Critical Infrastructure Security and Resilience
Election Security
Emergency Communications
Industrial Control Systems
Information and Communications Technology Supply Chain Security
Partnerships and Collaboration
Physical Security
Risk Management
How can we help?
GovernmentEducational InstitutionsIndustryState, Local, Tribal, and
TerritorialIndividuals and FamiliesSmall and Medium BusinessesFind Help
LocallyFaith-Based CommunityExecutivesHigh-Risk Communities
* Spotlight
* Resources & Tools
Resources & Tools
All Resources & Tools
Services
Programs
Resources
Training
Groups
* News & Events
News & Events
News
Events
Cybersecurity Alerts & Advisories
Directives
Request a CISA Speaker
Congressional Testimony
CISA Conferences
CISA Live!
* Careers
Careers
Benefits & Perks
HireVue Applicant Reasonable Accommodations Process
Hiring
Resume & Application Tips
Students & Recent Graduates
Veteran and Military Spouses
Work @ CISA
* About
About
Culture
Divisions & Offices
Regions
Leadership
Doing Business with CISA
Site Links
Reporting Employee and Contractor Misconduct
CISA GitHub
CISA Central
2023 Year In Review
Contact Us
Subscribe
Free Cyber ServicesElection Threat Updates#protect2024Secure Our WorldShields
UpReport A Cyber Issue
Breadcrumb
1. Home
2. News & Events
3. Cybersecurity Advisories
4. ICS Advisory
Share:
ICS Advisory
MYSCADA MYPRO MANAGER
Release Date
November 21, 2024
Alert Code
ICSA-24-326-07
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF(link is external)
1. EXECUTIVE SUMMARY
* CVSS v4 10.0
* ATTENTION: Exploitable remotely/low attack complexity
* Vendor: mySCADA
* Equipment: myPRO
* Vulnerabilities: OS Command Injection, Improper Authentication, Missing
Authentication for Critical Function, Path Traversal.
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow a remote attacker to
execute arbitrary commands or disclose sensitive information.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following mySCADA products are affected:
* myPRO Manager: Versions prior to 1.3
* myPRO Runtime: Versions prior to 9.2.1
3.2 VULNERABILITY OVERVIEW
3.2.1 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS
COMMAND INJECTION') CWE-78(LINK IS EXTERNAL)
A parameter within a command does not properly validate input within myPRO
Manager which could be exploited by an unauthenticated remote attacker to inject
arbitrary operating system commands.
CVE-2024-47407(link is external) has been assigned to this vulnerability. A CVSS
v3.1 base score of 10.0 has been calculated; the CVSS vector string is
(AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H(link is external)).
A CVSS v4 score has also been calculated for CVE-2024-47407(link is external). A
base score of 10.0 has been calculated; the CVSS vector string is
(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H(link is
external)).
3.2.2 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS
COMMAND INJECTION') CWE-78(LINK IS EXTERNAL)
An OS Command Injection vulnerability exists within myPRO Manager. A parameter
within a command can be exploited by an unauthenticated remote attacker to
inject arbitrary operating system commands.
CVE-2024-52034(link is external) has been assigned to this vulnerability. A CVSS
v3.1 base score of 10.0 has been calculated; the CVSS vector string is
(AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H(link is external)).
A CVSS v4 score has also been calculated for CVE-2024-52034(link is external). A
base score of 10.0 has been calculated; the CVSS vector string is
(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H(link is
external)).
3.2.3 IMPROPER AUTHENTICATION CWE-287(LINK IS EXTERNAL)
The web application uses a weak authentication mechanism to verify that a
request is coming from an authenticated and authorized resource.
CVE-2024-45369(link is external) has been assigned to this vulnerability. A CVSS
v3.1 base score of 8.1 has been calculated; the CVSS vector string is
(AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H(link is external)).
A CVSS v4 score has also been calculated for CVE-2024-45369(link is external). A
base score of 9.2 has been calculated; the CVSS vector string is
(CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N(link is
external)).
3.2.4 MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306(LINK IS EXTERNAL)
The administrative interface listens by default on all interfaces on a TCP port
and does not require authentication when being accessed
CVE-2024-47138(link is external) has been assigned to this vulnerability. A CVSS
v3.1 base score of 9.8 has been calculated; the CVSS vector string is
(AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H(link is external)).
A CVSS v4 score has also been calculated for CVE-2024-47138(link is external). A
base score of 9.3 has been calculated; the CVSS vector string is
(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N(link is
external)).
3.2.5 PATH TRAVERSAL: '.../...//' CWE-35(LINK IS EXTERNAL)
The backend does not sufficiently verify the user-controlled filename parameter
which makes it possible for an attacker to perform a path traversal attack and
retrieve arbitrary files from the file system
CVE-2024-50054(link is external) has been assigned to this vulnerability. A CVSS
v3.1 base score of 7.5 has been calculated; the CVSS vector string is
(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H(link is external)).
A CVSS v4 score has also been calculated for CVE-2024-50054(link is external). A
base score of 8.7 has been calculated; the CVSS vector string is
(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N(link is
external)).
3.3 BACKGROUND
* CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
* COUNTRIES/AREAS DEPLOYED: Worldwide
* COMPANY HEADQUARTERS LOCATION: Czech Republic
3.4 RESEARCHER
Michael Heinzl reported these vulnerabilities to CISA.
4. MITIGATIONS
mySCADA recommends updating to the latest versions.
* mySCADA PRO Manager 1.3(link is external)
* mySCADA PRO Runtime 9.2.1(link is external)
CISA recommends users take defensive measures to minimize the risk of
exploitation of these vulnerabilities, such as:
* Minimize network exposure for all control system devices and/or systems,
ensuring they are not accessible from the internet.
* Locate control system networks and remote devices behind firewalls and
isolating them from business networks.
* When remote access is required, use more secure methods, such as Virtual
Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should
be updated to the most current version available. Also recognize VPN is only
as secure as the connected devices.
CISA reminds organizations to perform proper impact analysis and risk assessment
prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices
on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber
defense best practices are available for reading and download, including
Improving Industrial Control Systems Cybersecurity with Defense-in-Depth
Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies
for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage at cisa.gov/ics in the technical information paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies.
Organizations observing suspected malicious activity should follow established
internal procedures and report findings to CISA for tracking and correlation
against other incidents.
CISA also recommends users take the following measures to protect themselves
from social engineering attacks:
* Do not click web links or open attachments in unsolicited email messages.
* Refer to Recognizing and Avoiding Email Scams for more information on
avoiding email scams.
* Refer to Avoiding Social Engineering and Phishing Attacks for more
information on social engineering attacks.
No known public exploitation specifically targeting these vulnerabilities has
been reported to CISA at this time.
5. UPDATE HISTORY
* November 21, 2024: Initial Publication
This product is provided subject to this Notification and this Privacy &
Use policy.
VENDOR
* mySCADA
TAGS
Sector: Critical Manufacturing Sector
Topics: Industrial Control System Vulnerabilities, Industrial Control Systems
PLEASE SHARE YOUR THOUGHTS
We recently updated our anonymous product survey; we’d welcome your feedback.
RELATED ADVISORIES
Nov 21, 2024
ICS Advisory | ICSA-24-326-06
SCHNEIDER ELECTRIC POWERLOGIC PM5300 SERIES
Nov 21, 2024
ICS Advisory | ICSA-24-326-02
OSCAT BASIC LIBRARY
Nov 21, 2024
ICS Advisory | ICSA-24-326-03
SCHNEIDER ELECTRIC MODICON M340, MC80, AND MOMENTUM UNITY M1E
Nov 21, 2024
ICS Advisory | ICSA-24-326-01
AUTOMATED LOGIC WEBCTRL PREMIUM SERVER
Return to top
* Topics
* Spotlight
* Resources & Tools
* News & Events
* Careers
* About
Cybersecurity & Infrastructure Security Agency
* Facebook
* Twitter
* LinkedIn
* YouTube
* Instagram
* RSS
CISA Central 1-844-Say-CISA SayCISA@cisa.dhs.gov
DHS Seal
CISA.gov
An official website of the U.S. Department of Homeland Security
* About CISA
* Budget and Performance
* DHS.gov
* Equal Opportunity & Accessibility
* FOIA Requests
* No FEAR Act
* Office of Inspector General
* Privacy Policy
* Subscribe
* The White House
* USA.gov
* Website Feedback